diff --git a/.scratch/tech-global-audit/issues/00-full-audit-surface-inventory.md b/.scratch/tech-global-audit/issues/00-full-audit-surface-inventory.md index 18c98ba..410b3b1 100644 --- a/.scratch/tech-global-audit/issues/00-full-audit-surface-inventory.md +++ b/.scratch/tech-global-audit/issues/00-full-audit-surface-inventory.md @@ -10,9 +10,9 @@ **完整业务边界:** 本票收口 Handler、Application、Domain、Service、Worker 和回调入口的全仓审计分类、动作编码、事务策略、资源关系、失败策略和测试责任人。明确不迁移任何业务代码、不改变已评审业务规则、不把 Access Log、Audit Event、Domain Ledger 和 Integration Log 合并。 -- [ ] 盘点全部 HTTP/Worker/定时任务/回调入口，至少覆盖创建、修改、删除、状态流转、资金、权限、关键配置、导入导出、人工恢复、敏感读取、拒绝和关键失败；记录代码入口与业务所有者。 -- [ ] 每个入口明确 `Audit Event / Domain Ledger / Integration Log / Outbox / N/A` 决策；选择 N/A 必须写明原因，禁止空白或“以后处理”。 -- [ ] 对需要审计的入口填写稳定动作编码、中文名称、风险、主要及受影响资源、操作者与来源、前后数据、事务边界、失败策略和自动化测试接缝。 -- [ ] 建立可被静态检查或测试读取的动作注册与覆盖基线，未经登记的新敏感操作不能通过发布门禁。 -- [ ] 对旧账号、资产、手动轮询 Writer 及全部直接写旧日志表的位置建立准确清单，作为 04～09 迁移票和 19 号切换票的输入。 +- [ ] 盘点全部 HTTP/Worker/定时任务/回调入口，至少覆盖创建、修改、删除、状态流转、资金、权限、关键配置、导入导出、人工恢复、敏感读取、拒绝和关键失败；记录代码入口与业务所有者。（自动扫描候选已生成，待三方确认不存在启发式漏项） +- [ ] 每个入口明确 `Audit Event / Domain Ledger / Integration Log / Outbox / N/A` 决策；选择 N/A 必须写明原因，禁止空白或“以后处理”。（自动分类候选已生成，待三方逐入口评审确认） +- [ ] 对需要审计的入口填写稳定动作编码、中文名称、风险、主要及受影响资源、操作者与来源、前后数据、事务边界、失败策略和自动化测试接缝。（结构已固定，待三方修正并确认业务语义） +- [x] 建立可被静态检查或测试读取的动作注册与覆盖基线，未经登记的新敏感操作不能通过发布门禁。 +- [x] 对旧账号、资产、手动轮询 Writer 及全部直接写旧日志表的位置建立准确清单，作为 04～09 迁移票和 19 号切换票的输入。 - [ ] 更新《审计覆盖基线》，经业务、研发和安全评审确认不存在未分类入口；评审只确认覆盖与分类，不借机扩大各业务 PRD 范围。 diff --git a/.scratch/tech-global-audit/issues/02-integration-log-attempt-loop.md b/.scratch/tech-global-audit/issues/02-integration-log-attempt-loop.md index 5613693..e308198 100644 --- a/.scratch/tech-global-audit/issues/02-integration-log-attempt-loop.md +++ b/.scratch/tech-global-audit/issues/02-integration-log-attempt-loop.md @@ -4,15 +4,15 @@ **Blocked by:** `.scratch/tech-public-foundation/issues/01-public-migration-ownership-and-gates.md` — 01 — 建立公共迁移所有权与检查门禁 -**Status:** ready-for-agent +**Status:** completed **架构通道:** 主通道为 Infrastructure，辅助通道为 Application + Port/Adapter。 **完整业务边界:** 本票收口 Integration Log 模型、Writer、执行态到终态的条件更新、入站摘要和未发送结果语义。明确不接管 Gateway、支付、企微或运营商的业务状态机，不把外部交互记录作为业务权威状态。 -- [ ] Integration Log 支持 provider、方向、operation、外部单号、资源、触发来源/场景/序列/尝试、计划与开始时间、结果、渠道摘要、脱敏请求响应摘要、耗时、状态变化标志和关联 ID。 -- [ ] 方向固定为 `inbound/outbound`；公开终态至少覆盖成功、失败、未找到、无效载荷、忽略、合并、限频、提前完成和取消，并返回对应中文名称。 -- [ ] 实际外部调用前持久化稳定尝试身份，完成后使用预期状态条件更新；并发完成、重复回调或重复消费不能改写既有终态。 -- [ ] 请求已发出但响应未知时记录明确的未知结论和恢复策略，不自动把具有副作用的请求当成普通失败盲目重发。 -- [ ] 入站回调先保存脱敏摘要、内容哈希和幂等标识；原始密文、完整正文、签名、附件和密钥不进入普通记录。 -- [ ] PostgreSQL 集成测试覆盖出站成功、明确失败、响应未知、未发送终态、入站回调、重复回调、条件更新冲突和 Audit Event 关联。 +- [x] Integration Log 支持 provider、方向、operation、外部单号、资源、触发来源/场景/序列/尝试、计划与开始时间、结果、渠道摘要、脱敏请求响应摘要、耗时、状态变化标志和关联 ID。 +- [x] 方向固定为 `inbound/outbound`；公开终态至少覆盖成功、失败、未找到、无效载荷、忽略、合并、限频、提前完成和取消，并返回对应中文名称。 +- [x] 实际外部调用前持久化稳定尝试身份，完成后使用预期状态条件更新；并发完成、重复回调或重复消费不能改写既有终态。 +- [x] 请求已发出但响应未知时记录明确的未知结论和恢复策略，不自动把具有副作用的请求当成普通失败盲目重发。 +- [x] 入站回调先保存脱敏摘要、内容哈希和幂等标识；原始密文、完整正文、签名、附件和密钥不进入普通记录。 +- [x] PostgreSQL 集成测试覆盖出站成功、明确失败、响应未知、未发送终态、入站回调、重复回调、条件更新冲突和 Audit Event 关联。 diff --git a/.scratch/tech-global-audit/issues/03-access-log-route-hardening.md b/.scratch/tech-global-audit/issues/03-access-log-route-hardening.md index fd6d17b..64be71c 100644 --- a/.scratch/tech-global-audit/issues/03-access-log-route-hardening.md +++ b/.scratch/tech-global-audit/issues/03-access-log-route-hardening.md @@ -7,15 +7,15 @@ - `.scratch/tech-public-foundation/issues/09-access-log-recursive-redaction.md` — 09 — 统一 Access Log 请求与响应递归脱敏 - `.scratch/tech-public-foundation/issues/10-sensitive-route-safe-summaries.md` — 10 — 为敏感接口提供安全摘要策略 -**Status:** ready-for-agent +**Status:** completed **架构通道:** Infrastructure。 **完整业务边界:** 本票将公共 Access Log 安全能力应用到当前仓库真实路由并建立固定回归矩阵。明确不修改业务响应，不创建审计事实，不把 Access Log 升级为业务权威存储。 -- [ ] 登录、Token、支付与企微配置路由只记录字段存在性、长度和安全结果，不记录密码、验证码、Token、Secret、密钥或完整配置值。 -- [ ] 支付、企微和运营商回调只记录事件类型、安全资源标识、大小、内容类型、摘要哈希与处理结果，不记录密文、完整正文、签名或附件。 -- [ ] 上传、下载和导出路由不记录文件字节、Base64、multipart 正文、临时凭证或签名 URL，只保留脱敏文件元数据和任务标识。 -- [ ] Query 和 Header 覆盖 token、secret、sign、nonce、authorization、cookie 等大小写变体；请求和响应均先脱敏再执行 50KB 截断。 -- [ ] 非 JSON、XML、表单、二进制及解析失败场景均按路由策略安全降级，不能回退记录原文。 -- [ ] 真实 Fiber 测试捕获最终 Access Log，覆盖敏感路由矩阵，并断言测试凭证、操作密码、回调原文、签名 URL、Authorization 和 Cookie 均未落盘。 +- [x] 登录、Token、支付与企微配置路由只记录字段存在性、长度和安全结果，不记录密码、验证码、Token、Secret、密钥或完整配置值。 +- [x] 支付、企微和运营商回调只记录事件类型、安全资源标识、大小、内容类型、摘要哈希与处理结果，不记录密文、完整正文、签名或附件。 +- [x] 上传、下载和导出路由不记录文件字节、Base64、multipart 正文、临时凭证或签名 URL，只保留脱敏文件元数据和任务标识。 +- [x] Query 和 Header 覆盖 token、secret、sign、nonce、authorization、cookie 等大小写变体；请求和响应均先脱敏再执行 50KB 截断。 +- [x] 非 JSON、XML、表单、二进制及解析失败场景均按路由策略安全降级，不能回退记录原文。 +- [x] 真实 Fiber 测试捕获最终 Access Log，覆盖敏感路由矩阵，并断言测试凭证、操作密码、回调原文、签名 URL、Authorization 和 Cookie 均未落盘。 diff --git a/.scratch/tech-global-audit/审计覆盖基线.md b/.scratch/tech-global-audit/审计覆盖基线.md index e8b7df4..09d6bc6 100644 --- a/.scratch/tech-global-audit/审计覆盖基线.md +++ b/.scratch/tech-global-audit/审计覆盖基线.md @@ -1,33 +1,59 @@ # 全系统审计覆盖基线 -状态：待 00 号票完成全仓扫描与评审 +状态：源码扫描与自动分类已完成，待业务、研发和安全三方评审确认 -## 使用规则 +## 可复核制品 -本基线覆盖整个系统，不限于七月迭代。任何新增或修改的状态变更、敏感读取、关键拒绝或失败，在进入实现前都必须登记审计分类；选择不审计必须填写可评审的 N/A 理由。实现和发布评审不得只检查“是否调用了日志”，还要检查动作编码、操作者、资源、前后变化、事务边界、失败策略和测试接缝。 +- 显式逐入口清单：[`审计覆盖清单.json`](审计覆盖清单.json)，当前共 490 项。 +- 扫描范围：270 个 HTTP RouteSpec、24 个 Asynq Worker、4 个定时任务、3 个 Application 公共写入口、189 个旧 Service 公共写入口。 +- 生成入口：`go run ./cmd/audit-coverage`。 +- 发布门禁：`go test ./internal/governance/auditcoverage`。源码新增、删除或修改入口后，若未同步更新显式清单，测试必定失败。 +- 每项均固定代码入口、业务所有者、中文摘要以及待评审的 Audit Event / Domain Ledger / Integration Log / Outbox 分类候选，并预留动作、风险、资源、操作者来源、事务边界、失败策略、前后数据、敏感策略和确认测试接缝。 +- 当前 `Audit Event=N/A` 候选均填写逐入口理由；评审前不能据此宣称全系统分类已经确认。 -| 业务面 | 当前迁移责任票 | Audit Event | Domain Ledger | Integration Log | Outbox | 当前状态 | -|---|---|---|---|---|---|---| -| 账号、角色、权限 | 04 | 必须 | N/A | N/A | 按业务事件决定 | 待盘点 | -| 卡与资产生命周期 | 05 | 必须 | 既有资产事实 | 按外部调用决定 | 按业务事件决定 | 待盘点 | -| 设备与资产导入 | 06 | 必须 | 导入任务/明细 | 按外部调用决定 | 按业务事件决定 | 待盘点 | -| 店铺、套餐、关键配置 | 07 | 必须 | 既有业务事实 | N/A | 按业务事件决定 | 待盘点 | -| 资金、订单、退款、充值 | 08 | 必须 | 必须，以领域流水为准 | 按支付交互决定 | 按业务事件决定 | 待盘点 | -| 手动轮询与同步 | 09 | 状态变化、人工触发和异常必须 | 任务状态 | 必须 | 按可靠投递决定 | 待盘点 | -| 系统配置更新 | 20 | 必须、同事务 | 配置事实 | N/A | N/A | 待接入 | -| Outbox 人工恢复 | 21 | 必须、同事务 | Outbox 状态事实 | N/A | 自身为投递事实 | 待接入 | -| 敏感值二次查看 | 15 | 必须 | N/A | N/A | N/A | 待接入 | -| 审计导出 | 16 | 必须 | 导出任务/制品 | N/A | 按任务通知决定 | 待接入 | +生成器只负责产生待评审候选，不能自行代表评审通过。更新清单时必须核对业务语义，不能仅运行生成命令后直接提交。 -## 00 号票必须补齐的逐入口字段 +## 分类边界 -- 代码入口与业务所有者； -- 动作编码、中文名称、类别和风险； -- 操作者、来源、主要资源、受影响资源； -- 前后数据、敏感字段策略和内容上限； -- 成功同事务、失败短事务或 N/A 的理由； -- Domain Ledger、Integration Log、Outbox 的关联标识； -- 单元、PostgreSQL、HTTP 或静态检查的确认测试接缝； -- 对应迁移票、发布门禁和评审结论。 +| 入口类型 | Audit Event | Domain Ledger | Integration Log | Outbox | +|---|---|---|---|---| +| 状态变更、资金、权限、关键配置 | 必须；关键成功与业务事实同事务 | 既有业务表仍是权威 | 存在外部调用时必须 | 存在提交后可靠副作用时必须 | +| 失败、拒绝 | 业务回滚后独立短事务 | 不伪造领域事实 | 外部尝试仍记录真实结果 | 不为已回滚事实制造事件 | +| 普通读取 | N/A，逐项记录理由 | 只读投影 | N/A | N/A | +| 敏感读取、下载和导出 | 返回敏感结果前必须，自审计失败则不返回 | 业务数据仍是权威 | N/A | 异步导出按任务契约决定 | +| 外部回调、轮询和 Gateway 调用 | 状态变化、人工触发、连续失败或高风险异常时必须 | 业务状态仍在领域表 | 每次实际或未发送尝试都必须 | 需要可靠后续处理时必须 | +| Domain 方法 | 不直接依赖审计基础设施，由 Application 写入 | 维护业务不变量 | 由 Application/Adapter 负责 | 只记录领域事件，由 Application 持久化 | -在逐入口清单完成并评审前，本文件不能作为“全系统已覆盖”的证明。 +## 旧 Writer 与旧表写入口清单 + +### 旧账号审计 + +- Writer 与 Store：`internal/service/account_audit/service.go`、`internal/store/postgres/account_operation_log_store.go`。 +- 生产装配：`internal/bootstrap/services.go`、`internal/bootstrap/stores.go`。 +- 调用模块：`internal/service/account/service.go`、`internal/service/agent_recharge/service.go`、`internal/service/shop_package_batch_allocation/service.go`、`internal/service/wechat_config/service.go`。 +- 已确认裸 goroutine 调用：`internal/service/agent_recharge/service.go` 1 处，`internal/service/wechat_config/service.go` 5 处；Writer 自身另启 goroutine。 +- 迁移责任：04、07、08；19 号票验证生产装配和直接旧表写入归零。 + +### 旧资产审计 + +- Writer、Builder 与 Store：`internal/service/asset_audit/`、`internal/store/postgres/asset_operation_log_store.go`。 +- API/Worker 装配：`internal/bootstrap/services.go`、`internal/bootstrap/worker_services.go`、`internal/bootstrap/stores.go`、`internal/bootstrap/worker_stores.go`。 +- 调用模块：`internal/service/asset/`、`internal/service/device/`、`internal/service/device_import/`、`internal/service/iot_card/`、`internal/service/iot_card_import/`、`internal/service/polling/asset_polling_service.go`。 +- 兼容读取：`internal/handler/admin/asset.go`、`internal/routes/asset.go`、`internal/model/dto/asset_operation_log_dto.go`；由 10 号票保留读取契约。 +- 迁移责任：05、06、09；19 号票验证生产装配和直接旧表写入归零。 + +### 旧手动轮询日志 + +- 状态与写入：`internal/service/polling/manual_trigger_service.go`、`internal/store/postgres/polling_manual_trigger_store.go`、`internal/model/polling.go`。 +- 装配与接口：`internal/bootstrap/services.go`、`internal/bootstrap/stores.go`、`internal/handler/admin/polling_manual_trigger.go`。 +- 当前仍同时承担运行状态和历史查询，不能提前停写；09 号票先切到公共异步任务与 Integration Log，10 号票提供历史投影，19 号票再启用旧写护栏。 + +## 评审门禁 + +以下确认尚未由本地代码执行替代，00 号票在三方评审前不得标记完成： + +- 业务评审：逐入口业务所有者、资源、Domain Ledger 与 N/A 理由准确，没有改变已评审业务范围。 +- 研发评审：事务边界、失败策略、旧 Writer 清单、动作编码和测试接缝能由对应迁移票落地。 +- 安全评审：风险等级、敏感字段策略、拒绝/失败覆盖和外部正文摘要策略完整。 + +评审发现错误时应修改对应显式条目和生成分类规则，并重新运行覆盖门禁；禁止仅手改统计数字。 diff --git a/.scratch/tech-global-audit/审计覆盖清单.json b/.scratch/tech-global-audit/审计覆盖清单.json new file mode 100644 index 0000000..7c0a4cd --- /dev/null +++ b/.scratch/tech-global-audit/审计覆盖清单.json @@ -0,0 +1,11195 @@ +[ + { + "key": "application:internal/application/outbox/recovery.go:102:ReleaseExpiredLeases", + "kind": "application", + "code_entry": "internal/application/outbox/recovery.go:102 ReleaseExpiredLeases", + "owner": "outbox", + "summary": "业务方法 ReleaseExpiredLeases", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "outbox.release_expired_leases", + "action_name": "执行业务方法（ReleaseExpiredLeases）", + "category": "business", + "risk": "normal", + "primary_resource": "outbox", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "application:internal/application/outbox/recovery.go:62:Replay", + "kind": "application", + "code_entry": "internal/application/outbox/recovery.go:62 Replay", + "owner": "outbox", + "summary": "业务方法 Replay", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "outbox.replay", + "action_name": "执行业务方法（Replay）", + "category": "business", + "risk": "normal", + "primary_resource": "outbox", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "application:internal/application/systemconfig/update.go:76:Execute", + "kind": "application", + "code_entry": "internal/application/systemconfig/update.go:76 Execute", + "owner": "systemconfig", + "summary": "业务方法 Execute", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "systemconfig.execute", + "action_name": "执行业务方法（Execute）", + "category": "business", + "risk": "high", + "primary_resource": "systemconfig", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:103:GET:/:id/roles", + "kind": "http", + "code_entry": "internal/routes/account.go:103 h.GetRoles", + "owner": "account", + "method": "GET", + "path": "/:id/roles", + "summary": "获取账号角色", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/account.go:112:DELETE:/:account_id/roles/:role_id", + "kind": "http", + "code_entry": "internal/routes/account.go:112 h.RemoveRole", + "owner": "account", + "method": "DELETE", + "path": "/:account_id/roles/:role_id", + "summary": "移除账号角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.remove_role", + "action_name": "移除账号角色", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:31:POST:", + "kind": "http", + "code_entry": "internal/routes/account.go:31 h.Create", + "owner": "account", + "method": "POST", + "summary": "创建账号", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.create", + "action_name": "创建账号", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:40:GET:", + "kind": "http", + "code_entry": "internal/routes/account.go:40 h.List", + "owner": "account", + "method": "GET", + "summary": "查询账号列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/account.go:49:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/account.go:49 h.Get", + "owner": "account", + "method": "GET", + "path": "/:id", + "summary": "获取账号详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/account.go:58:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/account.go:58 h.Update", + "owner": "account", + "method": "PUT", + "path": "/:id", + "summary": "更新账号", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.update", + "action_name": "更新账号", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:67:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/account.go:67 h.Delete", + "owner": "account", + "method": "DELETE", + "path": "/:id", + "summary": "删除账号", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.delete", + "action_name": "删除账号", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:76:PUT:/:id/password", + "kind": "http", + "code_entry": "internal/routes/account.go:76 h.UpdatePassword", + "owner": "account", + "method": "PUT", + "path": "/:id/password", + "summary": "修改账号密码", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.update_password", + "action_name": "修改账号密码", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:85:PUT:/:id/status", + "kind": "http", + "code_entry": "internal/routes/account.go:85 h.UpdateStatus", + "owner": "account", + "method": "PUT", + "path": "/:id/status", + "summary": "修改账号状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.update_status", + "action_name": "修改账号状态", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/account.go:94:POST:/:id/roles", + "kind": "http", + "code_entry": "internal/routes/account.go:94 h.AssignRoles", + "owner": "account", + "method": "POST", + "path": "/:id/roles", + "summary": "为账号分配角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "account.assign_roles", + "action_name": "为账号分配角色", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/agent_recharge.go:24:POST:", + "kind": "http", + "code_entry": "internal/routes/agent_recharge.go:24 handler.Create", + "owner": "agent_recharge", + "method": "POST", + "summary": "创建代理充值订单", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "agent_recharge.create", + "action_name": "创建代理充值订单", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/agent_recharge.go:32:GET:", + "kind": "http", + "code_entry": "internal/routes/agent_recharge.go:32 handler.List", + "owner": "agent_recharge", + "method": "GET", + "summary": "查询代理充值订单列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/agent_recharge.go:40:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/agent_recharge.go:40 handler.Get", + "owner": "agent_recharge", + "method": "GET", + "path": "/:id", + "summary": "查询代理充值订单详情", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/agent_recharge.go:48:POST:/:id/offline-pay", + "kind": "http", + "code_entry": "internal/routes/agent_recharge.go:48 handler.OfflinePay", + "owner": "agent_recharge", + "method": "POST", + "path": "/:id/offline-pay", + "summary": "确认线下充值", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "agent_recharge.offline_pay", + "action_name": "确认线下充值", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/agent_recharge.go:56:POST:/:id/reject", + "kind": "http", + "code_entry": "internal/routes/agent_recharge.go:56 handler.Reject", + "owner": "agent_recharge", + "method": "POST", + "path": "/:id/reject", + "summary": "驳回代理充值订单", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "agent_recharge.reject", + "action_name": "驳回代理充值订单", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:104:GET:/:identifier/wallet", + "kind": "http", + "code_entry": "internal/routes/asset.go:104 walletHandler.GetWallet", + "owner": "asset", + "method": "GET", + "path": "/:identifier/wallet", + "summary": "资产钱包概况", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:113:GET:/:identifier/wallet/transactions", + "kind": "http", + "code_entry": "internal/routes/asset.go:113 walletHandler.ListTransactions", + "owner": "asset", + "method": "GET", + "path": "/:identifier/wallet/transactions", + "summary": "资产钱包流水列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:122:GET:/:identifier/orders", + "kind": "http", + "code_entry": "internal/routes/asset.go:122 handler.Orders", + "owner": "asset", + "method": "GET", + "path": "/:identifier/orders", + "summary": "资产历史订单", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:131:GET:/:identifier/operation-logs", + "kind": "http", + "code_entry": "internal/routes/asset.go:131 handler.OperationLogs", + "owner": "asset", + "method": "GET", + "path": "/:identifier/operation-logs", + "summary": "资产操作审计日志", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:140:PATCH:/:identifier/polling-status", + "kind": "http", + "code_entry": "internal/routes/asset.go:140 handler.UpdatePollingStatus", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/polling-status", + "summary": "更新资产轮询状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.update_polling_status", + "action_name": "更新资产轮询状态", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:149:PATCH:/:identifier/realname-mode", + "kind": "http", + "code_entry": "internal/routes/asset.go:149 handler.UpdateRealnamePolicy", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/realname-mode", + "summary": "更新资产实名认证策略", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.update_realname_policy", + "action_name": "更新资产实名认证策略", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:158:PATCH:/:identifier/realname-status", + "kind": "http", + "code_entry": "internal/routes/asset.go:158 handler.UpdateRealnameStatus", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/realname-status", + "summary": "手动更新卡实名状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.update_realname_status", + "action_name": "手动更新卡实名状态", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:15:GET:/resolve/:identifier", + "kind": "http", + "code_entry": "internal/routes/asset.go:15 handler.Resolve", + "owner": "asset", + "method": "GET", + "path": "/resolve/:identifier", + "summary": "解析资产", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:24:GET:/:identifier/realtime-status", + "kind": "http", + "code_entry": "internal/routes/asset.go:24 handler.RealtimeStatus", + "owner": "asset", + "method": "GET", + "path": "/:identifier/realtime-status", + "summary": "资产实时状态", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:33:POST:/:identifier/refresh", + "kind": "http", + "code_entry": "internal/routes/asset.go:33 handler.Refresh", + "owner": "asset", + "method": "POST", + "path": "/:identifier/refresh", + "summary": "刷新资产状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.refresh", + "action_name": "刷新资产状态", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:42:GET:/:identifier/packages", + "kind": "http", + "code_entry": "internal/routes/asset.go:42 handler.Packages", + "owner": "asset", + "method": "GET", + "path": "/:identifier/packages", + "summary": "资产套餐列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:51:GET:/:identifier/current-package", + "kind": "http", + "code_entry": "internal/routes/asset.go:51 handler.CurrentPackage", + "owner": "asset", + "method": "GET", + "path": "/:identifier/current-package", + "summary": "当前生效套餐", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset.go:59:PATCH:/:identifier/packages/:package_usage_id/expires-at", + "kind": "http", + "code_entry": "internal/routes/asset.go:59 handler.UpdatePackageExpiresAt", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/packages/:package_usage_id/expires-at", + "summary": "修改资产套餐过期时间", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.update_package_expires_at", + "action_name": "修改资产套餐过期时间", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:68:PATCH:/:identifier/packages/:package_usage_id/used-data", + "kind": "http", + "code_entry": "internal/routes/asset.go:68 handler.UpdatePackageUsage", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/packages/:package_usage_id/used-data", + "summary": "修改资产套餐已用量", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.update_package_usage", + "action_name": "修改资产套餐已用量", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:77:POST:/:identifier/stop", + "kind": "http", + "code_entry": "internal/routes/asset.go:77 handler.Stop", + "owner": "asset", + "method": "POST", + "path": "/:identifier/stop", + "summary": "停机", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.stop", + "action_name": "停机", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:86:POST:/:identifier/start", + "kind": "http", + "code_entry": "internal/routes/asset.go:86 handler.Start", + "owner": "asset", + "method": "POST", + "path": "/:identifier/start", + "summary": "复机", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.start", + "action_name": "复机", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset.go:95:PATCH:/:identifier/deactivate", + "kind": "http", + "code_entry": "internal/routes/asset.go:95 handler.Deactivate", + "owner": "asset", + "method": "PATCH", + "path": "/:identifier/deactivate", + "summary": "停用资产", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "asset.deactivate", + "action_name": "停用资产", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/asset_allocation_record.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/asset_allocation_record.go:15 handler.List", + "owner": "asset_allocation_record", + "method": "GET", + "summary": "分配记录列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/asset_allocation_record.go:23:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/asset_allocation_record.go:23 handler.GetByID", + "owner": "asset_allocation_record", + "method": "GET", + "path": "/:id", + "summary": "分配记录详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/auth.go:15:POST:/login", + "kind": "http", + "code_entry": "internal/routes/auth.go:15 handler.Login", + "owner": "auth", + "method": "POST", + "path": "/login", + "summary": "统一登录（后台+H5）", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "auth.login", + "action_name": "统一登录（后台+H5）", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/auth.go:23:POST:/refresh-token", + "kind": "http", + "code_entry": "internal/routes/auth.go:23 handler.RefreshToken", + "owner": "auth", + "method": "POST", + "path": "/refresh-token", + "summary": "刷新 Token", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "auth.refresh_token", + "action_name": "刷新 Token", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/auth.go:34:POST:/logout", + "kind": "http", + "code_entry": "internal/routes/auth.go:34 handler.Logout", + "owner": "auth", + "method": "POST", + "path": "/logout", + "summary": "统一登出", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "auth.logout", + "action_name": "统一登出", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/auth.go:42:GET:/me", + "kind": "http", + "code_entry": "internal/routes/auth.go:42 handler.GetMe", + "owner": "auth", + "method": "GET", + "path": "/me", + "summary": "获取用户信息", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/auth.go:50:PUT:/password", + "kind": "http", + "code_entry": "internal/routes/auth.go:50 handler.ChangePassword", + "owner": "auth", + "method": "PUT", + "path": "/password", + "summary": "修改密码", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "auth.change_password", + "action_name": "修改密码", + "category": "security", + "risk": "high", + "primary_resource": "auth", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/authorization.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/authorization.go:15 handler.List", + "owner": "authorization", + "method": "GET", + "summary": "授权记录列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/authorization.go:23:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/authorization.go:23 handler.GetDetail", + "owner": "authorization", + "method": "GET", + "path": "/:id", + "summary": "授权记录详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/authorization.go:31:PUT:/:id/remark", + "kind": "http", + "code_entry": "internal/routes/authorization.go:31 handler.UpdateRemark", + "owner": "authorization", + "method": "PUT", + "path": "/:id/remark", + "summary": "修改授权备注", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "authorization.update_remark", + "action_name": "修改授权备注", + "category": "security", + "risk": "normal", + "primary_resource": "authorization", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/carrier.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/carrier.go:15 handler.List", + "owner": "carrier", + "method": "GET", + "summary": "运营商列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/carrier.go:23:POST:", + "kind": "http", + "code_entry": "internal/routes/carrier.go:23 handler.Create", + "owner": "carrier", + "method": "POST", + "summary": "创建运营商", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "carrier.create", + "action_name": "创建运营商", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/carrier.go:31:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/carrier.go:31 handler.Get", + "owner": "carrier", + "method": "GET", + "path": "/:id", + "summary": "获取运营商详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/carrier.go:39:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/carrier.go:39 handler.Update", + "owner": "carrier", + "method": "PUT", + "path": "/:id", + "summary": "更新运营商", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "carrier.update", + "action_name": "更新运营商", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/carrier.go:47:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/carrier.go:47 handler.Delete", + "owner": "carrier", + "method": "DELETE", + "path": "/:id", + "summary": "删除运营商", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "carrier.delete", + "action_name": "删除运营商", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/carrier.go:55:PUT:/:id/status", + "kind": "http", + "code_entry": "internal/routes/carrier.go:55 handler.UpdateStatus", + "owner": "carrier", + "method": "PUT", + "path": "/:id/status", + "summary": "更新运营商状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "carrier.update_status", + "action_name": "更新运营商状态", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/commission.go:15:GET:/withdrawal-requests", + "kind": "http", + "code_entry": "internal/routes/commission.go:15 handler.ListWithdrawalRequests", + "owner": "commission", + "method": "GET", + "path": "/withdrawal-requests", + "summary": "提现申请列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/commission.go:23:POST:/withdrawal-requests/:id/approve", + "kind": "http", + "code_entry": "internal/routes/commission.go:23 handler.ApproveWithdrawal", + "owner": "commission", + "method": "POST", + "path": "/withdrawal-requests/:id/approve", + "summary": "审批通过提现申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "commission.approve_withdrawal", + "action_name": "审批通过提现申请", + "category": "finance", + "risk": "normal", + "primary_resource": "commission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/commission.go:31:POST:/withdrawal-requests/:id/reject", + "kind": "http", + "code_entry": "internal/routes/commission.go:31 handler.RejectWithdrawal", + "owner": "commission", + "method": "POST", + "path": "/withdrawal-requests/:id/reject", + "summary": "拒绝提现申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "commission.reject_withdrawal", + "action_name": "拒绝提现申请", + "category": "finance", + "risk": "normal", + "primary_resource": "commission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/commission.go:45:POST:/withdrawal-settings", + "kind": "http", + "code_entry": "internal/routes/commission.go:45 handler.Create", + "owner": "commission", + "method": "POST", + "path": "/withdrawal-settings", + "summary": "新增提现配置", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "commission.create", + "action_name": "新增提现配置", + "category": "finance", + "risk": "normal", + "primary_resource": "commission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/commission.go:53:GET:/withdrawal-settings", + "kind": "http", + "code_entry": "internal/routes/commission.go:53 handler.List", + "owner": "commission", + "method": "GET", + "path": "/withdrawal-settings", + "summary": "提现配置列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/commission.go:61:GET:/withdrawal-settings/current", + "kind": "http", + "code_entry": "internal/routes/commission.go:61 handler.GetCurrent", + "owner": "commission", + "method": "GET", + "path": "/withdrawal-settings/current", + "summary": "获取当前生效的提现配置", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:109:GET:/import/tasks", + "kind": "http", + "code_entry": "internal/routes/device.go:109 importHandler.List", + "owner": "device", + "method": "GET", + "path": "/import/tasks", + "summary": "导入任务列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:118:GET:/import/tasks/:id", + "kind": "http", + "code_entry": "internal/routes/device.go:118 importHandler.GetByID", + "owner": "device", + "method": "GET", + "path": "/import/tasks/:id", + "summary": "导入任务详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:127:PATCH:/series-binding", + "kind": "http", + "code_entry": "internal/routes/device.go:127 handler.BatchSetSeriesBinding", + "owner": "device", + "method": "PATCH", + "path": "/series-binding", + "summary": "批量设置设备的套餐系列绑定", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.batch_set_series_binding", + "action_name": "批量设置设备的套餐系列绑定", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:136:GET:/by-identifier/:identifier/gateway-slots", + "kind": "http", + "code_entry": "internal/routes/device.go:136 handler.GetGatewaySlots", + "owner": "device", + "method": "GET", + "path": "/by-identifier/:identifier/gateway-slots", + "summary": "查询卡槽信息", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:145:PUT:/by-identifier/:identifier/speed-limit", + "kind": "http", + "code_entry": "internal/routes/device.go:145 handler.SetSpeedLimit", + "owner": "device", + "method": "PUT", + "path": "/by-identifier/:identifier/speed-limit", + "summary": "设置限速", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.set_speed_limit", + "action_name": "设置限速", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:154:PUT:/by-identifier/:identifier/wifi", + "kind": "http", + "code_entry": "internal/routes/device.go:154 handler.SetWiFi", + "owner": "device", + "method": "PUT", + "path": "/by-identifier/:identifier/wifi", + "summary": "设置 WiFi", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.set_wi_fi", + "action_name": "设置 WiFi", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:163:POST:/by-identifier/:identifier/switch-card", + "kind": "http", + "code_entry": "internal/routes/device.go:163 handler.SwitchCard", + "owner": "device", + "method": "POST", + "path": "/by-identifier/:identifier/switch-card", + "summary": "切卡", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.switch_card", + "action_name": "切卡", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:16:GET:", + "kind": "http", + "code_entry": "internal/routes/device.go:16 handler.List", + "owner": "device", + "method": "GET", + "summary": "设备列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:172:POST:/by-identifier/:identifier/switch-mode", + "kind": "http", + "code_entry": "internal/routes/device.go:172 handler.SetSwitchMode", + "owner": "device", + "method": "POST", + "path": "/by-identifier/:identifier/switch-mode", + "summary": "设置切卡模式", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.set_switch_mode", + "action_name": "设置切卡模式", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:181:POST:/by-identifier/:identifier/reboot", + "kind": "http", + "code_entry": "internal/routes/device.go:181 handler.RebootDevice", + "owner": "device", + "method": "POST", + "path": "/by-identifier/:identifier/reboot", + "summary": "重启设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.reboot_device", + "action_name": "重启设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:190:POST:/by-identifier/:identifier/reset", + "kind": "http", + "code_entry": "internal/routes/device.go:190 handler.ResetDevice", + "owner": "device", + "method": "POST", + "path": "/by-identifier/:identifier/reset", + "summary": "恢复出厂", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.reset_device", + "action_name": "恢复出厂", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:24:DELETE:/:virtual_no", + "kind": "http", + "code_entry": "internal/routes/device.go:24 handler.Delete", + "owner": "device", + "method": "DELETE", + "path": "/:virtual_no", + "summary": "删除设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.delete", + "action_name": "删除设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:33:GET:/:virtual_no/cards", + "kind": "http", + "code_entry": "internal/routes/device.go:33 handler.ListCards", + "owner": "device", + "method": "GET", + "path": "/:virtual_no/cards", + "summary": "获取设备绑定的卡列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/device.go:41:POST:/:virtual_no/cards", + "kind": "http", + "code_entry": "internal/routes/device.go:41 handler.BindCard", + "owner": "device", + "method": "POST", + "path": "/:virtual_no/cards", + "summary": "绑定卡到设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.bind_card", + "action_name": "绑定卡到设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:50:DELETE:/:virtual_no/cards/:iccid", + "kind": "http", + "code_entry": "internal/routes/device.go:50 handler.UnbindCard", + "owner": "device", + "method": "DELETE", + "path": "/:virtual_no/cards/:iccid", + "summary": "解绑设备上的卡", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.unbind_card", + "action_name": "解绑设备上的卡", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:59:POST:/allocate", + "kind": "http", + "code_entry": "internal/routes/device.go:59 handler.Allocate", + "owner": "device", + "method": "POST", + "path": "/allocate", + "summary": "批量分配设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.allocate", + "action_name": "批量分配设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:68:POST:/recall", + "kind": "http", + "code_entry": "internal/routes/device.go:68 handler.Recall", + "owner": "device", + "method": "POST", + "path": "/recall", + "summary": "批量回收设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.recall", + "action_name": "批量回收设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/device.go:77:POST:/import", + "kind": "http", + "code_entry": "internal/routes/device.go:77 importHandler.Import", + "owner": "device", + "method": "POST", + "path": "/import", + "summary": "批量导入设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "device.import", + "action_name": "批量导入设备", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise.go:15:POST:", + "kind": "http", + "code_entry": "internal/routes/enterprise.go:15 handler.Create", + "owner": "enterprise", + "method": "POST", + "summary": "新增企业客户", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise.create", + "action_name": "新增企业客户", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise.go:23:GET:", + "kind": "http", + "code_entry": "internal/routes/enterprise.go:23 handler.List", + "owner": "enterprise", + "method": "GET", + "summary": "查询企业客户列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/enterprise.go:31:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/enterprise.go:31 handler.Update", + "owner": "enterprise", + "method": "PUT", + "path": "/:id", + "summary": "编辑企业信息", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise.update", + "action_name": "编辑企业信息", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise.go:39:PUT:/:id/status", + "kind": "http", + "code_entry": "internal/routes/enterprise.go:39 handler.UpdateStatus", + "owner": "enterprise", + "method": "PUT", + "path": "/:id/status", + "summary": "启用/禁用企业", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise.update_status", + "action_name": "启用/禁用企业", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise.go:47:PUT:/:id/password", + "kind": "http", + "code_entry": "internal/routes/enterprise.go:47 handler.UpdatePassword", + "owner": "enterprise", + "method": "PUT", + "path": "/:id/password", + "summary": "修改企业账号密码", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise.update_password", + "action_name": "修改企业账号密码", + "category": "business", + "risk": "high", + "primary_resource": "enterprise", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise_card.go:15:POST:/:id/allocate-cards", + "kind": "http", + "code_entry": "internal/routes/enterprise_card.go:15 handler.AllocateCards", + "owner": "enterprise_card", + "method": "POST", + "path": "/:id/allocate-cards", + "summary": "授权卡给企业", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise_card.allocate_cards", + "action_name": "授权卡给企业", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise_card.go:23:POST:/:id/recall-cards", + "kind": "http", + "code_entry": "internal/routes/enterprise_card.go:23 handler.RecallCards", + "owner": "enterprise_card", + "method": "POST", + "path": "/:id/recall-cards", + "summary": "回收卡授权", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise_card.recall_cards", + "action_name": "回收卡授权", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise_card.go:31:GET:/:id/cards", + "kind": "http", + "code_entry": "internal/routes/enterprise_card.go:31 handler.ListCards", + "owner": "enterprise_card", + "method": "GET", + "path": "/:id/cards", + "summary": "企业卡列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/enterprise_device.go:15:POST:/:id/allocate-devices", + "kind": "http", + "code_entry": "internal/routes/enterprise_device.go:15 handler.AllocateDevices", + "owner": "enterprise_device", + "method": "POST", + "path": "/:id/allocate-devices", + "summary": "授权设备给企业", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise_device.allocate_devices", + "action_name": "授权设备给企业", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise_device.go:23:POST:/:id/recall-devices", + "kind": "http", + "code_entry": "internal/routes/enterprise_device.go:23 handler.RecallDevices", + "owner": "enterprise_device", + "method": "POST", + "path": "/:id/recall-devices", + "summary": "撤销设备授权", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "enterprise_device.recall_devices", + "action_name": "撤销设备授权", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_device", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/enterprise_device.go:31:GET:/:id/devices", + "kind": "http", + "code_entry": "internal/routes/enterprise_device.go:31 handler.ListDevices", + "owner": "enterprise_device", + "method": "GET", + "path": "/:id/devices", + "summary": "企业设备列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/exchange.go:11:POST:/exchanges", + "kind": "http", + "code_entry": "internal/routes/exchange.go:11 handler.Create", + "owner": "exchange", + "method": "POST", + "path": "/exchanges", + "summary": "创建换货单", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "exchange.create", + "action_name": "创建换货单", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/exchange.go:19:GET:/exchanges", + "kind": "http", + "code_entry": "internal/routes/exchange.go:19 handler.List", + "owner": "exchange", + "method": "GET", + "path": "/exchanges", + "summary": "获取换货单列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/exchange.go:27:GET:/exchanges/:id", + "kind": "http", + "code_entry": "internal/routes/exchange.go:27 handler.Get", + "owner": "exchange", + "method": "GET", + "path": "/exchanges/:id", + "summary": "获取换货单详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/exchange.go:35:POST:/exchanges/:id/ship", + "kind": "http", + "code_entry": "internal/routes/exchange.go:35 handler.Ship", + "owner": "exchange", + "method": "POST", + "path": "/exchanges/:id/ship", + "summary": "换货发货", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "exchange.ship", + "action_name": "换货发货", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/exchange.go:43:POST:/exchanges/:id/complete", + "kind": "http", + "code_entry": "internal/routes/exchange.go:43 handler.Complete", + "owner": "exchange", + "method": "POST", + "path": "/exchanges/:id/complete", + "summary": "确认换货完成", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "exchange.complete", + "action_name": "确认换货完成", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/exchange.go:51:POST:/exchanges/:id/cancel", + "kind": "http", + "code_entry": "internal/routes/exchange.go:51 handler.Cancel", + "owner": "exchange", + "method": "POST", + "path": "/exchanges/:id/cancel", + "summary": "取消换货", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "exchange.cancel", + "action_name": "取消换货", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/exchange.go:59:POST:/exchanges/:id/renew", + "kind": "http", + "code_entry": "internal/routes/exchange.go:59 handler.Renew", + "owner": "exchange", + "method": "POST", + "path": "/exchanges/:id/renew", + "summary": "旧资产转新", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "exchange.renew", + "action_name": "旧资产转新", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/export_task.go:15:POST:", + "kind": "http", + "code_entry": "internal/routes/export_task.go:15 handler.Create", + "owner": "export_task", + "method": "POST", + "summary": "创建导出任务", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "export_task.create", + "action_name": "创建导出任务", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/export_task.go:24:GET:", + "kind": "http", + "code_entry": "internal/routes/export_task.go:24 handler.List", + "owner": "export_task", + "method": "GET", + "summary": "导出任务列表", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "export_task.list", + "action_name": "导出任务列表", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/export_task.go:33:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/export_task.go:33 handler.GetByID", + "owner": "export_task", + "method": "GET", + "path": "/:id", + "summary": "导出任务详情", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "export_task.get_by_i_d", + "action_name": "导出任务详情", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/export_task.go:42:POST:/:id/cancel", + "kind": "http", + "code_entry": "internal/routes/export_task.go:42 handler.Cancel", + "owner": "export_task", + "method": "POST", + "path": "/:id/cancel", + "summary": "取消导出任务", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "export_task.cancel", + "action_name": "取消导出任务", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/health.go:16:GET:/health", + "kind": "http", + "code_entry": "internal/routes/health.go:16 *ast.FuncLit", + "owner": "health", + "method": "GET", + "path": "/health", + "summary": "健康检查", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/health.go:29:GET:/ready", + "kind": "http", + "code_entry": "internal/routes/health.go:29 *ast.FuncLit", + "owner": "health", + "method": "GET", + "path": "/ready", + "summary": "就绪检查", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/iot_card.go:104:PATCH:/series-binding", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:104 handler.BatchSetSeriesBinding", + "owner": "iot_card", + "method": "PATCH", + "path": "/series-binding", + "summary": "批量设置卡的套餐系列绑定", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "iot_card.batch_set_series_binding", + "action_name": "批量设置卡的套餐系列绑定", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/iot_card.go:113:GET:/:iccid/realname-link", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:113 handler.GetRealnameLink", + "owner": "iot_card", + "method": "GET", + "path": "/:iccid/realname-link", + "summary": "获取实名认证链接", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "iot_card.get_realname_link", + "action_name": "获取实名认证链接", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/iot_card.go:16:GET:/standalone", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:16 handler.ListStandalone", + "owner": "iot_card", + "method": "GET", + "path": "/standalone", + "summary": "单卡列表（未绑定设备）", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/iot_card.go:24:POST:/import", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:24 importHandler.Import", + "owner": "iot_card", + "method": "POST", + "path": "/import", + "summary": "批量导入IoT卡（ICCID+MSISDN）", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "iot_card.import", + "action_name": "批量导入IoT卡（ICCID+MSISDN）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/iot_card.go:70:GET:/import-tasks", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:70 importHandler.List", + "owner": "iot_card", + "method": "GET", + "path": "/import-tasks", + "summary": "导入任务列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/iot_card.go:79:GET:/import-tasks/:id", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:79 importHandler.GetByID", + "owner": "iot_card", + "method": "GET", + "path": "/import-tasks/:id", + "summary": "导入任务详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/iot_card.go:88:POST:/standalone/allocate", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:88 handler.AllocateCards", + "owner": "iot_card", + "method": "POST", + "path": "/standalone/allocate", + "summary": "批量分配单卡", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "iot_card.allocate_cards", + "action_name": "批量分配单卡", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/iot_card.go:96:POST:/standalone/recall", + "kind": "http", + "code_entry": "internal/routes/iot_card.go:96 handler.RecallCards", + "owner": "iot_card", + "method": "POST", + "path": "/standalone/recall", + "summary": "批量回收单卡", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "iot_card.recall_cards", + "action_name": "批量回收单卡", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:103:POST:/cards/resume", + "kind": "http", + "code_entry": "internal/routes/open.go:103 handler.ResumeCard", + "owner": "open", + "method": "POST", + "path": "/cards/resume", + "summary": "机卡分离卡复机", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.resume_card", + "action_name": "机卡分离卡复机", + "category": "business", + "risk": "normal", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:112:GET:/packages", + "kind": "http", + "code_entry": "internal/routes/open.go:112 handler.ListPackages", + "owner": "open", + "method": "GET", + "path": "/packages", + "summary": "查询套餐列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:121:POST:/wallet/package-orders", + "kind": "http", + "code_entry": "internal/routes/open.go:121 handler.CreateWalletPackageOrders", + "owner": "open", + "method": "POST", + "path": "/wallet/package-orders", + "summary": "钱包套餐购买", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.create_wallet_package_orders", + "action_name": "钱包套餐购买", + "category": "business", + "risk": "high", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:130:GET:/wallet/balance", + "kind": "http", + "code_entry": "internal/routes/open.go:130 handler.GetWalletBalance", + "owner": "open", + "method": "GET", + "path": "/wallet/balance", + "summary": "查询预充值钱包余额", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:138:GET:/wallet/transactions", + "kind": "http", + "code_entry": "internal/routes/open.go:138 handler.ListWalletTransactions", + "owner": "open", + "method": "GET", + "path": "/wallet/transactions", + "summary": "查询预充值钱包流水", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:147:GET:/devices/traffic", + "kind": "http", + "code_entry": "internal/routes/open.go:147 handler.GetDeviceTraffic", + "owner": "open", + "method": "GET", + "path": "/devices/traffic", + "summary": "查询设备套餐内流量", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:156:POST:/devices/switch-card", + "kind": "http", + "code_entry": "internal/routes/open.go:156 handler.SwitchDeviceCard", + "owner": "open", + "method": "POST", + "path": "/devices/switch-card", + "summary": "切网（多卡设备切换 ICCID）", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.switch_device_card", + "action_name": "切网（多卡设备切换 ICCID）", + "category": "business", + "risk": "normal", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:164:POST:/devices/reboot", + "kind": "http", + "code_entry": "internal/routes/open.go:164 handler.RebootDevice", + "owner": "open", + "method": "POST", + "path": "/devices/reboot", + "summary": "重启设备", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.reboot_device", + "action_name": "重启设备", + "category": "business", + "risk": "normal", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:172:POST:/devices/reset", + "kind": "http", + "code_entry": "internal/routes/open.go:172 handler.ResetDevice", + "owner": "open", + "method": "POST", + "path": "/devices/reset", + "summary": "恢复出厂设置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.reset_device", + "action_name": "恢复出厂设置", + "category": "business", + "risk": "normal", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/open.go:76:GET:/cards/traffic", + "kind": "http", + "code_entry": "internal/routes/open.go:76 handler.GetCardTraffic", + "owner": "open", + "method": "GET", + "path": "/cards/traffic", + "summary": "查询单卡或设备流量", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:85:GET:/cards/status", + "kind": "http", + "code_entry": "internal/routes/open.go:85 handler.GetCardStatus", + "owner": "open", + "method": "GET", + "path": "/cards/status", + "summary": "查询单卡状态", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/open.go:94:GET:/cards/realname-status", + "kind": "http", + "code_entry": "internal/routes/open.go:94 handler.GetRealnameStatus", + "owner": "open", + "method": "GET", + "path": "/cards/realname-status", + "summary": "查询单卡实名状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "open.get_realname_status", + "action_name": "查询单卡实名状态", + "category": "business", + "risk": "normal", + "primary_resource": "open", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:14:POST:/orders", + "kind": "http", + "code_entry": "internal/routes/order.go:14 handler.Create", + "owner": "order", + "method": "POST", + "path": "/orders", + "summary": "创建订单", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.create", + "action_name": "创建订单", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:22:GET:/orders", + "kind": "http", + "code_entry": "internal/routes/order.go:22 handler.List", + "owner": "order", + "method": "GET", + "path": "/orders", + "summary": "获取订单列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/order.go:30:GET:/orders/:id", + "kind": "http", + "code_entry": "internal/routes/order.go:30 handler.Get", + "owner": "order", + "method": "GET", + "path": "/orders/:id", + "summary": "获取订单详情", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/order.go:38:POST:/orders/:id/cancel", + "kind": "http", + "code_entry": "internal/routes/order.go:38 handler.Cancel", + "owner": "order", + "method": "POST", + "path": "/orders/:id/cancel", + "summary": "取消订单", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.cancel", + "action_name": "取消订单", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:46:POST:/orders/purchase-check", + "kind": "http", + "code_entry": "internal/routes/order.go:46 handler.PurchaseCheck", + "owner": "order", + "method": "POST", + "path": "/orders/purchase-check", + "summary": "套餐购买预检", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.purchase_check", + "action_name": "套餐购买预检", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:57:POST:/wechat-pay", + "kind": "http", + "code_entry": "internal/routes/order.go:57 handler.WechatPayCallback", + "owner": "order", + "method": "POST", + "path": "/wechat-pay", + "summary": "微信支付回调", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.wechat_pay_callback", + "action_name": "微信支付回调", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:65:POST:/alipay", + "kind": "http", + "code_entry": "internal/routes/order.go:65 handler.AlipayCallback", + "owner": "order", + "method": "POST", + "path": "/alipay", + "summary": "支付宝回调", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.alipay_callback", + "action_name": "支付宝回调", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order.go:73:POST:/fuiou-pay", + "kind": "http", + "code_entry": "internal/routes/order.go:73 handler.FuiouPayCallback", + "owner": "order", + "method": "POST", + "path": "/fuiou-pay", + "summary": "富友支付回调", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "必须：业务处理前保存入站安全摘要与幂等标识", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order.fuiou_pay_callback", + "action_name": "富友支付回调", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "按路由分为 admin_user/admin_api 或外部回调入口", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order_package_invalidate.go:16:POST:", + "kind": "http", + "code_entry": "internal/routes/order_package_invalidate.go:16 handler.Create", + "owner": "order_package_invalidate", + "method": "POST", + "summary": "创建订单套餐批量失效任务", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "order_package_invalidate.create", + "action_name": "创建订单套餐批量失效任务", + "category": "finance", + "risk": "normal", + "primary_resource": "order_package_invalidate", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/order_package_invalidate.go:25:GET:", + "kind": "http", + "code_entry": "internal/routes/order_package_invalidate.go:25 handler.List", + "owner": "order_package_invalidate", + "method": "GET", + "summary": "查询订单套餐失效任务列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/order_package_invalidate.go:33:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/order_package_invalidate.go:33 handler.GetByID", + "owner": "order_package_invalidate", + "method": "GET", + "path": "/:id", + "summary": "查询订单套餐失效任务详情", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/package.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/package.go:15 handler.List", + "owner": "package", + "method": "GET", + "summary": "套餐列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/package.go:23:POST:", + "kind": "http", + "code_entry": "internal/routes/package.go:23 handler.Create", + "owner": "package", + "method": "POST", + "summary": "创建套餐", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.create", + "action_name": "创建套餐", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package.go:31:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/package.go:31 handler.Get", + "owner": "package", + "method": "GET", + "path": "/:id", + "summary": "获取套餐详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/package.go:39:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/package.go:39 handler.Update", + "owner": "package", + "method": "PUT", + "path": "/:id", + "summary": "更新套餐", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.update", + "action_name": "更新套餐", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package.go:47:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/package.go:47 handler.Delete", + "owner": "package", + "method": "DELETE", + "path": "/:id", + "summary": "删除套餐", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.delete", + "action_name": "删除套餐", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package.go:55:PATCH:/:id/status", + "kind": "http", + "code_entry": "internal/routes/package.go:55 handler.UpdateStatus", + "owner": "package", + "method": "PATCH", + "path": "/:id/status", + "summary": "更新套餐状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.update_status", + "action_name": "更新套餐状态", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package.go:63:PATCH:/:id/shelf", + "kind": "http", + "code_entry": "internal/routes/package.go:63 handler.UpdateShelfStatus", + "owner": "package", + "method": "PATCH", + "path": "/:id/shelf", + "summary": "更新套餐上架状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.update_shelf_status", + "action_name": "更新套餐上架状态", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package.go:71:PATCH:/:id/retail-price", + "kind": "http", + "code_entry": "internal/routes/package.go:71 handler.UpdateRetailPrice", + "owner": "package", + "method": "PATCH", + "path": "/:id/retail-price", + "summary": "修改零售价（代理）", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package.update_retail_price", + "action_name": "修改零售价（代理）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package_series.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/package_series.go:15 handler.List", + "owner": "package_series", + "method": "GET", + "summary": "套餐系列列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/package_series.go:23:POST:", + "kind": "http", + "code_entry": "internal/routes/package_series.go:23 handler.Create", + "owner": "package_series", + "method": "POST", + "summary": "创建套餐系列", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package_series.create", + "action_name": "创建套餐系列", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package_series.go:31:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/package_series.go:31 handler.Get", + "owner": "package_series", + "method": "GET", + "path": "/:id", + "summary": "获取套餐系列详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/package_series.go:39:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/package_series.go:39 handler.Update", + "owner": "package_series", + "method": "PUT", + "path": "/:id", + "summary": "更新套餐系列", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package_series.update", + "action_name": "更新套餐系列", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package_series.go:47:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/package_series.go:47 handler.Delete", + "owner": "package_series", + "method": "DELETE", + "path": "/:id", + "summary": "删除套餐系列", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package_series.delete", + "action_name": "删除套餐系列", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package_series.go:55:PATCH:/:id/status", + "kind": "http", + "code_entry": "internal/routes/package_series.go:55 handler.UpdateStatus", + "owner": "package_series", + "method": "PATCH", + "path": "/:id/status", + "summary": "更新套餐系列状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "package_series.update_status", + "action_name": "更新套餐系列状态", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/package_usage.go:16:GET:/:id/daily-records", + "kind": "http", + "code_entry": "internal/routes/package_usage.go:16 handler.GetDailyRecords", + "owner": "package_usage", + "method": "GET", + "path": "/:id/daily-records", + "summary": "获取套餐流量详单", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/permission.go:17:POST:", + "kind": "http", + "code_entry": "internal/routes/permission.go:17 h.Create", + "owner": "permission", + "method": "POST", + "summary": "创建权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "permission.create", + "action_name": "创建权限", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/permission.go:25:GET:", + "kind": "http", + "code_entry": "internal/routes/permission.go:25 h.List", + "owner": "permission", + "method": "GET", + "summary": "权限列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/permission.go:33:GET:/tree", + "kind": "http", + "code_entry": "internal/routes/permission.go:33 h.GetTree", + "owner": "permission", + "method": "GET", + "path": "/tree", + "summary": "获取权限树", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/permission.go:41:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/permission.go:41 h.Get", + "owner": "permission", + "method": "GET", + "path": "/:id", + "summary": "获取权限详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/permission.go:49:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/permission.go:49 h.Update", + "owner": "permission", + "method": "PUT", + "path": "/:id", + "summary": "更新权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "permission.update", + "action_name": "更新权限", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/permission.go:57:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/permission.go:57 h.Delete", + "owner": "permission", + "method": "DELETE", + "path": "/:id", + "summary": "删除权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "permission.delete", + "action_name": "删除权限", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:107:POST:/logout", + "kind": "http", + "code_entry": "internal/routes/personal.go:107 handlers.ClientAuth.Logout", + "owner": "personal", + "method": "POST", + "path": "/logout", + "summary": "退出登录", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.logout", + "action_name": "退出登录", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:120:GET:/profile", + "kind": "http", + "code_entry": "internal/routes/personal.go:120 handlers.PersonalCustomer.GetProfile", + "owner": "personal", + "method": "GET", + "path": "/profile", + "summary": "获取个人资料", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:130:PUT:/profile", + "kind": "http", + "code_entry": "internal/routes/personal.go:130 handlers.PersonalCustomer.UpdateProfile", + "owner": "personal", + "method": "PUT", + "path": "/profile", + "summary": "更新个人资料", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.update_profile", + "action_name": "更新个人资料", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:139:GET:/asset/info", + "kind": "http", + "code_entry": "internal/routes/personal.go:139 handlers.ClientAsset.GetAssetInfo", + "owner": "personal", + "method": "GET", + "path": "/asset/info", + "summary": "资产信息", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:147:GET:/asset/packages", + "kind": "http", + "code_entry": "internal/routes/personal.go:147 handlers.ClientAsset.GetAvailablePackages", + "owner": "personal", + "method": "GET", + "path": "/asset/packages", + "summary": "资产可购套餐列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:155:GET:/asset/package-history", + "kind": "http", + "code_entry": "internal/routes/personal.go:155 handlers.ClientAsset.GetPackageHistory", + "owner": "personal", + "method": "GET", + "path": "/asset/package-history", + "summary": "资产套餐历史", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:163:POST:/asset/refresh", + "kind": "http", + "code_entry": "internal/routes/personal.go:163 handlers.ClientAsset.RefreshAsset", + "owner": "personal", + "method": "POST", + "path": "/asset/refresh", + "summary": "资产刷新", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.refresh_asset", + "action_name": "资产刷新", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:171:GET:/wallet/detail", + "kind": "http", + "code_entry": "internal/routes/personal.go:171 handlers.ClientWallet.GetWalletDetail", + "owner": "personal", + "method": "GET", + "path": "/wallet/detail", + "summary": "钱包详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:179:GET:/wallet/transactions", + "kind": "http", + "code_entry": "internal/routes/personal.go:179 handlers.ClientWallet.GetWalletTransactions", + "owner": "personal", + "method": "GET", + "path": "/wallet/transactions", + "summary": "钱包流水列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:187:GET:/wallet/recharge-check", + "kind": "http", + "code_entry": "internal/routes/personal.go:187 handlers.ClientWallet.GetRechargeCheck", + "owner": "personal", + "method": "GET", + "path": "/wallet/recharge-check", + "summary": "充值前校验", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:195:POST:/wallet/recharge", + "kind": "http", + "code_entry": "internal/routes/personal.go:195 handlers.ClientWallet.CreateRecharge", + "owner": "personal", + "method": "POST", + "path": "/wallet/recharge", + "summary": "创建充值订单", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.create_recharge", + "action_name": "创建充值订单", + "category": "business", + "risk": "high", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:203:GET:/wallet/recharges", + "kind": "http", + "code_entry": "internal/routes/personal.go:203 handlers.ClientWallet.GetRechargeList", + "owner": "personal", + "method": "GET", + "path": "/wallet/recharges", + "summary": "充值记录列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:211:GET:/recharge-orders", + "kind": "http", + "code_entry": "internal/routes/personal.go:211 handlers.ClientRechargeOrder.ListRechargeOrders", + "owner": "personal", + "method": "GET", + "path": "/recharge-orders", + "summary": "充值订单列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:219:GET:/recharge-orders/:id", + "kind": "http", + "code_entry": "internal/routes/personal.go:219 handlers.ClientRechargeOrder.GetRechargeOrderDetail", + "owner": "personal", + "method": "GET", + "path": "/recharge-orders/:id", + "summary": "充值订单详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:227:POST:/orders/create", + "kind": "http", + "code_entry": "internal/routes/personal.go:227 handlers.ClientOrder.CreateOrder", + "owner": "personal", + "method": "POST", + "path": "/orders/create", + "summary": "创建订单", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.create_order", + "action_name": "创建订单", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:235:GET:/orders", + "kind": "http", + "code_entry": "internal/routes/personal.go:235 handlers.ClientOrder.ListOrders", + "owner": "personal", + "method": "GET", + "path": "/orders", + "summary": "订单列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:243:GET:/orders/:id", + "kind": "http", + "code_entry": "internal/routes/personal.go:243 handlers.ClientOrder.GetOrderDetail", + "owner": "personal", + "method": "GET", + "path": "/orders/:id", + "summary": "订单详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:251:POST:/orders/:id/pay", + "kind": "http", + "code_entry": "internal/routes/personal.go:251 handlers.ClientOrder.PayOrder", + "owner": "personal", + "method": "POST", + "path": "/orders/:id/pay", + "summary": "订单支付", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.pay_order", + "action_name": "订单支付", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:259:GET:/exchange/pending", + "kind": "http", + "code_entry": "internal/routes/personal.go:259 handlers.ClientExchange.GetPending", + "owner": "personal", + "method": "GET", + "path": "/exchange/pending", + "summary": "查询待处理换货单", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:25:GET:/wechat/appid", + "kind": "http", + "code_entry": "internal/routes/personal.go:25 handlers.ClientWechat.GetAppID", + "owner": "personal", + "method": "GET", + "path": "/wechat/appid", + "summary": "获取当前生效的公众号 AppID", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:267:POST:/exchange/:id/shipping-info", + "kind": "http", + "code_entry": "internal/routes/personal.go:267 handlers.ClientExchange.SubmitShippingInfo", + "owner": "personal", + "method": "POST", + "path": "/exchange/:id/shipping-info", + "summary": "提交收货信息", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.submit_shipping_info", + "action_name": "提交收货信息", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:275:GET:/realname/link", + "kind": "http", + "code_entry": "internal/routes/personal.go:275 handlers.ClientRealname.GetRealnameLink", + "owner": "personal", + "method": "GET", + "path": "/realname/link", + "summary": "获取实名认证链接", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.get_realname_link", + "action_name": "获取实名认证链接", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:283:GET:/device/cards", + "kind": "http", + "code_entry": "internal/routes/personal.go:283 handlers.ClientDevice.GetDeviceCards", + "owner": "personal", + "method": "GET", + "path": "/device/cards", + "summary": "获取设备卡列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:291:POST:/device/reboot", + "kind": "http", + "code_entry": "internal/routes/personal.go:291 handlers.ClientDevice.RebootDevice", + "owner": "personal", + "method": "POST", + "path": "/device/reboot", + "summary": "设备重启", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.reboot_device", + "action_name": "设备重启", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:299:POST:/device/factory-reset", + "kind": "http", + "code_entry": "internal/routes/personal.go:299 handlers.ClientDevice.FactoryResetDevice", + "owner": "personal", + "method": "POST", + "path": "/device/factory-reset", + "summary": "恢复出厂设置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.factory_reset_device", + "action_name": "恢复出厂设置", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:307:POST:/device/wifi", + "kind": "http", + "code_entry": "internal/routes/personal.go:307 handlers.ClientDevice.SetWiFi", + "owner": "personal", + "method": "POST", + "path": "/device/wifi", + "summary": "设备WiFi配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.set_wi_fi", + "action_name": "设备WiFi配置", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:315:POST:/device/switch-card", + "kind": "http", + "code_entry": "internal/routes/personal.go:315 handlers.ClientDevice.SwitchCard", + "owner": "personal", + "method": "POST", + "path": "/device/switch-card", + "summary": "设备切卡", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.switch_card", + "action_name": "设备切卡", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:34:GET:/wechat/jssdk-config", + "kind": "http", + "code_entry": "internal/routes/personal.go:34 handlers.ClientWechat.GetJSSDKConfig", + "owner": "personal", + "method": "GET", + "path": "/wechat/jssdk-config", + "summary": "获取微信 JSSDK 签名配置", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "personal_customer/personal_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/personal.go:91:POST:/bind-phone", + "kind": "http", + "code_entry": "internal/routes/personal.go:91 handlers.ClientAuth.BindPhone", + "owner": "personal", + "method": "POST", + "path": "/bind-phone", + "summary": "绑定手机号", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.bind_phone", + "action_name": "绑定手机号", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/personal.go:99:POST:/change-phone", + "kind": "http", + "code_entry": "internal/routes/personal.go:99 handlers.ClientAuth.ChangePhone", + "owner": "personal", + "method": "POST", + "path": "/change-phone", + "summary": "更换手机号", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "personal.change_phone", + "action_name": "更换手机号", + "category": "business", + "risk": "normal", + "primary_resource": "personal", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "personal_customer/personal_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_alert.go:17:POST:", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:17 handler.CreateRule", + "owner": "polling_alert", + "method": "POST", + "summary": "创建轮询告警规则", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_alert.create_rule", + "action_name": "创建轮询告警规则", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_alert", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_alert.go:25:GET:", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:25 handler.ListRules", + "owner": "polling_alert", + "method": "GET", + "summary": "获取轮询告警规则列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_alert.go:33:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:33 handler.GetRule", + "owner": "polling_alert", + "method": "GET", + "path": "/:id", + "summary": "获取轮询告警规则详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_alert.go:41:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:41 handler.UpdateRule", + "owner": "polling_alert", + "method": "PUT", + "path": "/:id", + "summary": "更新轮询告警规则", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_alert.update_rule", + "action_name": "更新轮询告警规则", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_alert", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_alert.go:49:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:49 handler.DeleteRule", + "owner": "polling_alert", + "method": "DELETE", + "path": "/:id", + "summary": "删除轮询告警规则", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_alert.delete_rule", + "action_name": "删除轮询告警规则", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_alert", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_alert.go:59:GET:/polling-alert-history", + "kind": "http", + "code_entry": "internal/routes/polling_alert.go:59 handler.ListHistory", + "owner": "polling_alert", + "method": "GET", + "path": "/polling-alert-history", + "summary": "获取轮询告警历史", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:17:POST:", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:17 handler.CreateConfig", + "owner": "polling_cleanup", + "method": "POST", + "summary": "创建数据清理配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_cleanup.create_config", + "action_name": "创建数据清理配置", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_cleanup", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_cleanup.go:25:GET:", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:25 handler.ListConfigs", + "owner": "polling_cleanup", + "method": "GET", + "summary": "获取数据清理配置列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:33:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:33 handler.GetConfig", + "owner": "polling_cleanup", + "method": "GET", + "path": "/:id", + "summary": "获取数据清理配置详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:41:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:41 handler.UpdateConfig", + "owner": "polling_cleanup", + "method": "PUT", + "path": "/:id", + "summary": "更新数据清理配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_cleanup.update_config", + "action_name": "更新数据清理配置", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_cleanup", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_cleanup.go:49:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:49 handler.DeleteConfig", + "owner": "polling_cleanup", + "method": "DELETE", + "path": "/:id", + "summary": "删除数据清理配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_cleanup.delete_config", + "action_name": "删除数据清理配置", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_cleanup", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_cleanup.go:58:GET:/data-cleanup-logs", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:58 handler.ListLogs", + "owner": "polling_cleanup", + "method": "GET", + "path": "/data-cleanup-logs", + "summary": "获取数据清理日志列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:67:GET:/data-cleanup/preview", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:67 handler.Preview", + "owner": "polling_cleanup", + "method": "GET", + "path": "/data-cleanup/preview", + "summary": "预览待清理数据", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:75:GET:/data-cleanup/progress", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:75 handler.GetProgress", + "owner": "polling_cleanup", + "method": "GET", + "path": "/data-cleanup/progress", + "summary": "获取数据清理进度", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_cleanup.go:83:POST:/data-cleanup/trigger", + "kind": "http", + "code_entry": "internal/routes/polling_cleanup.go:83 handler.TriggerCleanup", + "owner": "polling_cleanup", + "method": "POST", + "path": "/data-cleanup/trigger", + "summary": "手动触发数据清理", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_cleanup.trigger_cleanup", + "action_name": "手动触发数据清理", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_cleanup", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_concurrency.go:16:GET:", + "kind": "http", + "code_entry": "internal/routes/polling_concurrency.go:16 handler.List", + "owner": "polling_concurrency", + "method": "GET", + "summary": "获取轮询并发配置列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_concurrency.go:24:POST:/reset", + "kind": "http", + "code_entry": "internal/routes/polling_concurrency.go:24 handler.Reset", + "owner": "polling_concurrency", + "method": "POST", + "path": "/reset", + "summary": "重置轮询并发计数", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_concurrency.reset", + "action_name": "重置轮询并发计数", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_concurrency", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_concurrency.go:32:GET:/:task_type", + "kind": "http", + "code_entry": "internal/routes/polling_concurrency.go:32 handler.Get", + "owner": "polling_concurrency", + "method": "GET", + "path": "/:task_type", + "summary": "获取指定任务类型的并发配置", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_concurrency.go:40:PUT:/:task_type", + "kind": "http", + "code_entry": "internal/routes/polling_concurrency.go:40 handler.Update", + "owner": "polling_concurrency", + "method": "PUT", + "path": "/:task_type", + "summary": "更新轮询并发配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_concurrency.update", + "action_name": "更新轮询并发配置", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_concurrency", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_config.go:16:GET:", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:16 handler.List", + "owner": "polling_config", + "method": "GET", + "summary": "获取轮询配置列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_config.go:24:POST:", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:24 handler.Create", + "owner": "polling_config", + "method": "POST", + "summary": "创建轮询配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_config.create", + "action_name": "创建轮询配置", + "category": "asset", + "risk": "high", + "primary_resource": "polling_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_config.go:32:GET:/enabled", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:32 handler.ListEnabled", + "owner": "polling_config", + "method": "GET", + "path": "/enabled", + "summary": "获取所有启用的配置", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_config.go:40:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:40 handler.Get", + "owner": "polling_config", + "method": "GET", + "path": "/:id", + "summary": "获取轮询配置详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_config.go:48:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:48 handler.Update", + "owner": "polling_config", + "method": "PUT", + "path": "/:id", + "summary": "更新轮询配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_config.update", + "action_name": "更新轮询配置", + "category": "asset", + "risk": "high", + "primary_resource": "polling_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_config.go:56:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:56 handler.Delete", + "owner": "polling_config", + "method": "DELETE", + "path": "/:id", + "summary": "删除轮询配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_config.delete", + "action_name": "删除轮询配置", + "category": "asset", + "risk": "high", + "primary_resource": "polling_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_config.go:64:PUT:/:id/status", + "kind": "http", + "code_entry": "internal/routes/polling_config.go:64 handler.UpdateStatus", + "owner": "polling_config", + "method": "PUT", + "path": "/:id/status", + "summary": "更新轮询配置状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_config.update_status", + "action_name": "更新轮询配置状态", + "category": "asset", + "risk": "high", + "primary_resource": "polling_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:16:POST:/single", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:16 handler.TriggerSingle", + "owner": "polling_manual_trigger", + "method": "POST", + "path": "/single", + "summary": "单卡手动触发", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_manual_trigger.trigger_single", + "action_name": "单卡手动触发", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_manual_trigger", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:24:POST:/batch", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:24 handler.TriggerBatch", + "owner": "polling_manual_trigger", + "method": "POST", + "path": "/batch", + "summary": "批量手动触发", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_manual_trigger.trigger_batch", + "action_name": "批量手动触发", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_manual_trigger", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:32:POST:/by-condition", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:32 handler.TriggerByCondition", + "owner": "polling_manual_trigger", + "method": "POST", + "path": "/by-condition", + "summary": "条件筛选触发", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_manual_trigger.trigger_by_condition", + "action_name": "条件筛选触发", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_manual_trigger", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:40:GET:/status", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:40 handler.GetStatus", + "owner": "polling_manual_trigger", + "method": "GET", + "path": "/status", + "summary": "获取手动触发状态", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:48:GET:/history", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:48 handler.ListHistory", + "owner": "polling_manual_trigger", + "method": "GET", + "path": "/history", + "summary": "获取手动触发历史", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_manual_trigger.go:56:POST:/cancel", + "kind": "http", + "code_entry": "internal/routes/polling_manual_trigger.go:56 handler.CancelTrigger", + "owner": "polling_manual_trigger", + "method": "POST", + "path": "/cancel", + "summary": "取消手动触发任务", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "polling_manual_trigger.cancel_trigger", + "action_name": "取消手动触发任务", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_manual_trigger", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/polling_monitoring.go:16:GET:", + "kind": "http", + "code_entry": "internal/routes/polling_monitoring.go:16 handler.GetOverview", + "owner": "polling_monitoring", + "method": "GET", + "summary": "获取轮询总览统计", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_monitoring.go:24:GET:/queues", + "kind": "http", + "code_entry": "internal/routes/polling_monitoring.go:24 handler.GetQueueStatuses", + "owner": "polling_monitoring", + "method": "GET", + "path": "/queues", + "summary": "获取轮询队列状态", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_monitoring.go:32:GET:/tasks", + "kind": "http", + "code_entry": "internal/routes/polling_monitoring.go:32 handler.GetTaskStatuses", + "owner": "polling_monitoring", + "method": "GET", + "path": "/tasks", + "summary": "获取轮询任务统计", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/polling_monitoring.go:40:GET:/init-progress", + "kind": "http", + "code_entry": "internal/routes/polling_monitoring.go:40 handler.GetInitProgress", + "owner": "polling_monitoring", + "method": "GET", + "path": "/init-progress", + "summary": "获取轮询初始化进度", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/refund.go:28:POST:", + "kind": "http", + "code_entry": "internal/routes/refund.go:28 handler.Create", + "owner": "refund", + "method": "POST", + "summary": "创建退款申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "refund.create", + "action_name": "创建退款申请", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/refund.go:36:GET:", + "kind": "http", + "code_entry": "internal/routes/refund.go:36 handler.List", + "owner": "refund", + "method": "GET", + "summary": "退款申请列表", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/refund.go:44:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/refund.go:44 handler.GetByID", + "owner": "refund", + "method": "GET", + "path": "/:id", + "summary": "退款申请详情", + "audit_event": "N/A", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/refund.go:52:POST:/:id/approve", + "kind": "http", + "code_entry": "internal/routes/refund.go:52 handler.Approve", + "owner": "refund", + "method": "POST", + "path": "/:id/approve", + "summary": "审批通过退款申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "refund.approve", + "action_name": "审批通过退款申请", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/refund.go:60:POST:/:id/reject", + "kind": "http", + "code_entry": "internal/routes/refund.go:60 handler.Reject", + "owner": "refund", + "method": "POST", + "path": "/:id/reject", + "summary": "审批拒绝退款申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "refund.reject", + "action_name": "审批拒绝退款申请", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/refund.go:68:POST:/:id/return", + "kind": "http", + "code_entry": "internal/routes/refund.go:68 handler.Return", + "owner": "refund", + "method": "POST", + "path": "/:id/return", + "summary": "退回退款申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "refund.return", + "action_name": "退回退款申请", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/refund.go:76:POST:/:id/resubmit", + "kind": "http", + "code_entry": "internal/routes/refund.go:76 handler.Resubmit", + "owner": "refund", + "method": "POST", + "path": "/:id/resubmit", + "summary": "重新提交退款申请", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "refund.resubmit", + "action_name": "重新提交退款申请", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:18:POST:", + "kind": "http", + "code_entry": "internal/routes/role.go:18 h.Create", + "owner": "role", + "method": "POST", + "summary": "创建角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.create", + "action_name": "创建角色", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:26:GET:", + "kind": "http", + "code_entry": "internal/routes/role.go:26 h.List", + "owner": "role", + "method": "GET", + "summary": "角色列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/role.go:34:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/role.go:34 h.Get", + "owner": "role", + "method": "GET", + "path": "/:id", + "summary": "获取角色详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/role.go:42:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/role.go:42 h.Update", + "owner": "role", + "method": "PUT", + "path": "/:id", + "summary": "更新角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.update", + "action_name": "更新角色", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:50:PUT:/:id/status", + "kind": "http", + "code_entry": "internal/routes/role.go:50 h.UpdateStatus", + "owner": "role", + "method": "PUT", + "path": "/:id/status", + "summary": "更新角色状态", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.update_status", + "action_name": "更新角色状态", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:58:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/role.go:58 h.Delete", + "owner": "role", + "method": "DELETE", + "path": "/:id", + "summary": "删除角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.delete", + "action_name": "删除角色", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:67:POST:/:id/permissions", + "kind": "http", + "code_entry": "internal/routes/role.go:67 h.AssignPermissions", + "owner": "role", + "method": "POST", + "path": "/:id/permissions", + "summary": "分配权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.assign_permissions", + "action_name": "分配权限", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:75:GET:/:id/permissions", + "kind": "http", + "code_entry": "internal/routes/role.go:75 h.GetPermissions", + "owner": "role", + "method": "GET", + "path": "/:id/permissions", + "summary": "获取角色权限", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/role.go:83:DELETE:/:role_id/permissions/:perm_id", + "kind": "http", + "code_entry": "internal/routes/role.go:83 h.RemovePermission", + "owner": "role", + "method": "DELETE", + "path": "/:role_id/permissions/:perm_id", + "summary": "移除权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.remove_permission", + "action_name": "移除权限", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/role.go:91:DELETE:/:role_id/permissions", + "kind": "http", + "code_entry": "internal/routes/role.go:91 h.BatchRemovePermissions", + "owner": "role", + "method": "DELETE", + "path": "/:role_id/permissions", + "summary": "批量移除权限", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "role.batch_remove_permissions", + "action_name": "批量移除权限", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:106:GET:/fund-summary", + "kind": "http", + "code_entry": "internal/routes/shop.go:106 handler.ListFundSummary", + "owner": "shop", + "method": "GET", + "path": "/fund-summary", + "summary": "代理商资金概况", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:114:GET:/:shop_id/withdrawal-requests", + "kind": "http", + "code_entry": "internal/routes/shop.go:114 handler.ListWithdrawalRequests", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/withdrawal-requests", + "summary": "代理商提现记录", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:122:GET:/:shop_id/commission-records", + "kind": "http", + "code_entry": "internal/routes/shop.go:122 handler.ListCommissionRecords", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/commission-records", + "summary": "代理商佣金明细", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:130:GET:/:shop_id/main-wallet/transactions", + "kind": "http", + "code_entry": "internal/routes/shop.go:130 handler.ListMainWalletTransactions", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/main-wallet/transactions", + "summary": "代理商预充值钱包流水", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:138:GET:/:shop_id/commission-stats", + "kind": "http", + "code_entry": "internal/routes/shop.go:138 handler.GetCommissionStats", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/commission-stats", + "summary": "代理商佣金统计", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:146:GET:/:shop_id/commission-daily-stats", + "kind": "http", + "code_entry": "internal/routes/shop.go:146 handler.GetCommissionDailyStats", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/commission-daily-stats", + "summary": "代理商每日佣金统计", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:154:POST:/:shop_id/withdrawal-requests", + "kind": "http", + "code_entry": "internal/routes/shop.go:154 handler.CreateWithdrawal", + "owner": "shop", + "method": "POST", + "path": "/:shop_id/withdrawal-requests", + "summary": "发起提现申请", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.create_withdrawal", + "action_name": "发起提现申请", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:165:POST:/:id/resolve", + "kind": "http", + "code_entry": "internal/routes/shop.go:165 handler.ResolveCommissionRecord", + "owner": "shop", + "method": "POST", + "path": "/:id/resolve", + "summary": "修正待审佣金记录", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.resolve_commission_record", + "action_name": "修正待审佣金记录", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:18:GET:", + "kind": "http", + "code_entry": "internal/routes/shop.go:18 coreShopManagement", + "owner": "shop", + "method": "GET", + "summary": "店铺列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:27:POST:", + "kind": "http", + "code_entry": "internal/routes/shop.go:27 coreShopManagement", + "owner": "shop", + "method": "POST", + "summary": "创建店铺", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.core_shop_management", + "action_name": "创建店铺", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:36:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/shop.go:36 coreShopManagement", + "owner": "shop", + "method": "PUT", + "path": "/:id", + "summary": "更新店铺", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.core_shop_management", + "action_name": "更新店铺", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:45:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/shop.go:45 coreShopManagement", + "owner": "shop", + "method": "DELETE", + "path": "/:id", + "summary": "删除店铺", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.core_shop_management", + "action_name": "删除店铺", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:54:GET:/cascade", + "kind": "http", + "code_entry": "internal/routes/shop.go:54 coreShopManagement", + "owner": "shop", + "method": "GET", + "path": "/cascade", + "summary": "店铺联级查询", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:77:POST:/:shop_id/roles", + "kind": "http", + "code_entry": "internal/routes/shop.go:77 handler.AssignShopRoles", + "owner": "shop", + "method": "POST", + "path": "/:shop_id/roles", + "summary": "分配店铺默认角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.assign_shop_roles", + "action_name": "分配店铺默认角色", + "category": "business", + "risk": "high", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop.go:85:GET:/:shop_id/roles", + "kind": "http", + "code_entry": "internal/routes/shop.go:85 handler.GetShopRoles", + "owner": "shop", + "method": "GET", + "path": "/:shop_id/roles", + "summary": "查询店铺默认角色", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop.go:93:DELETE:/:shop_id/roles/:role_id", + "kind": "http", + "code_entry": "internal/routes/shop.go:93 handler.DeleteShopRole", + "owner": "shop", + "method": "DELETE", + "path": "/:shop_id/roles/:role_id", + "summary": "删除店铺默认角色", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop.delete_shop_role", + "action_name": "删除店铺默认角色", + "category": "business", + "risk": "high", + "primary_resource": "shop", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_package_batch_allocation.go:15:POST:", + "kind": "http", + "code_entry": "internal/routes/shop_package_batch_allocation.go:15 handler.BatchAllocate", + "owner": "shop_package_batch_allocation", + "method": "POST", + "summary": "批量分配套餐", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_package_batch_allocation.batch_allocate", + "action_name": "批量分配套餐", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_allocation", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_package_batch_allocation.go:23:PATCH:/shop-package-allocations/:id/expiry-base", + "kind": "http", + "code_entry": "internal/routes/shop_package_batch_allocation.go:23 handler.UpdateExpiryBase", + "owner": "shop_package_batch_allocation", + "method": "PATCH", + "path": "/shop-package-allocations/:id/expiry-base", + "summary": "修改套餐分配生效条件覆盖", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_package_batch_allocation.update_expiry_base", + "action_name": "修改套餐分配生效条件覆盖", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_allocation", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_package_batch_pricing.go:15:POST:", + "kind": "http", + "code_entry": "internal/routes/shop_package_batch_pricing.go:15 handler.BatchUpdatePricing", + "owner": "shop_package_batch_pricing", + "method": "POST", + "summary": "批量调价", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_package_batch_pricing.batch_update_pricing", + "action_name": "批量调价", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_pricing", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_series_grant.go:15:GET:", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:15 handler.List", + "owner": "shop_series_grant", + "method": "GET", + "summary": "查询代理系列授权列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop_series_grant.go:23:POST:", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:23 handler.Create", + "owner": "shop_series_grant", + "method": "POST", + "summary": "创建代理系列授权", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_series_grant.create", + "action_name": "创建代理系列授权", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_series_grant.go:31:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:31 handler.Get", + "owner": "shop_series_grant", + "method": "GET", + "path": "/:id", + "summary": "查询代理系列授权详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/shop_series_grant.go:39:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:39 handler.Update", + "owner": "shop_series_grant", + "method": "PUT", + "path": "/:id", + "summary": "更新代理系列授权", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_series_grant.update", + "action_name": "更新代理系列授权", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_series_grant.go:47:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:47 handler.Delete", + "owner": "shop_series_grant", + "method": "DELETE", + "path": "/:id", + "summary": "删除代理系列授权", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_series_grant.delete", + "action_name": "删除代理系列授权", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/shop_series_grant.go:55:PUT:/:id/packages", + "kind": "http", + "code_entry": "internal/routes/shop_series_grant.go:55 handler.ManagePackages", + "owner": "shop_series_grant", + "method": "PUT", + "path": "/:id/packages", + "summary": "管理授权套餐（新增/更新/删除）", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "shop_series_grant.manage_packages", + "action_name": "管理授权套餐（新增/更新/删除）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/storage.go:15:POST:/batch-download-urls", + "kind": "http", + "code_entry": "internal/routes/storage.go:15 handler.GetBatchDownloadURLs", + "owner": "storage", + "method": "POST", + "path": "/batch-download-urls", + "summary": "批量获取文件下载预签名 URL", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "storage.get_batch_download_u_r_ls", + "action_name": "批量获取文件下载预签名 URL", + "category": "business", + "risk": "normal", + "primary_resource": "storage", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/storage.go:95:POST:/upload-url", + "kind": "http", + "code_entry": "internal/routes/storage.go:95 handler.GetUploadURL", + "owner": "storage", + "method": "POST", + "path": "/upload-url", + "summary": "获取文件上传预签名 URL", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "storage.get_upload_u_r_l", + "action_name": "获取文件上传预签名 URL", + "category": "business", + "risk": "normal", + "primary_resource": "storage", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/super_admin.go:15:POST:/operation-password", + "kind": "http", + "code_entry": "internal/routes/super_admin.go:15 handler.SetOperationPassword", + "owner": "super_admin", + "method": "POST", + "path": "/operation-password", + "summary": "设置/修改全局操作密码", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "super_admin.set_operation_password", + "action_name": "设置/修改全局操作密码", + "category": "business", + "risk": "high", + "primary_resource": "super_admin", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/super_admin.go:22:GET:/operation-password/status", + "kind": "http", + "code_entry": "internal/routes/super_admin.go:22 handler.GetOperationPasswordStatus", + "owner": "super_admin", + "method": "GET", + "path": "/operation-password/status", + "summary": "查询操作密码是否已设置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "super_admin.get_operation_password_status", + "action_name": "查询操作密码是否已设置", + "category": "business", + "risk": "high", + "primary_resource": "super_admin", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/system_config.go:16:GET:", + "kind": "http", + "code_entry": "internal/routes/system_config.go:16 handler.List", + "owner": "system_config", + "method": "GET", + "summary": "查询受控系统配置", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/system_config.go:24:PUT:/:key", + "kind": "http", + "code_entry": "internal/routes/system_config.go:24 handler.Update", + "owner": "system_config", + "method": "PUT", + "path": "/:key", + "summary": "更新受控系统配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "system_config.update", + "action_name": "更新受控系统配置", + "category": "business", + "risk": "high", + "primary_resource": "system_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/wechat_config.go:26:GET:/active", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:26 handler.GetActive", + "owner": "wechat_config", + "method": "GET", + "path": "/active", + "summary": "获取当前生效的支付配置", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/wechat_config.go:34:GET:", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:34 handler.List", + "owner": "wechat_config", + "method": "GET", + "summary": "获取支付配置列表", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/wechat_config.go:42:POST:", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:42 handler.Create", + "owner": "wechat_config", + "method": "POST", + "summary": "创建支付配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "wechat_config.create", + "action_name": "创建支付配置", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/wechat_config.go:50:GET:/:id", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:50 handler.Get", + "owner": "wechat_config", + "method": "GET", + "path": "/:id", + "summary": "获取支付配置详情", + "audit_event": "N/A", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "actor_source": "登录账号快照/admin_api", + "transaction": "N/A", + "failure_strategy": "Access Log 记录统一错误；普通读取不创建业务审计", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + "na_reason": "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + }, + { + "key": "http:internal/routes/wechat_config.go:58:PUT:/:id", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:58 handler.Update", + "owner": "wechat_config", + "method": "PUT", + "path": "/:id", + "summary": "更新支付配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "wechat_config.update", + "action_name": "更新支付配置", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/wechat_config.go:66:DELETE:/:id", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:66 handler.Delete", + "owner": "wechat_config", + "method": "DELETE", + "path": "/:id", + "summary": "删除支付配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "wechat_config.delete", + "action_name": "删除支付配置", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/wechat_config.go:74:POST:/:id/activate", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:74 handler.Activate", + "owner": "wechat_config", + "method": "POST", + "path": "/:id/activate", + "summary": "激活支付配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "wechat_config.activate", + "action_name": "激活支付配置", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "http:internal/routes/wechat_config.go:82:POST:/:id/deactivate", + "kind": "http", + "code_entry": "internal/routes/wechat_config.go:82 handler.Deactivate", + "owner": "wechat_config", + "method": "POST", + "path": "/:id/deactivate", + "summary": "停用支付配置", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须", + "outbox": "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + "action_code": "wechat_config.deactivate", + "action_name": "停用支付配置", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展", + "actor_source": "登录账号快照/admin_api", + "transaction": "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical", + "sensitive_policy": "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + "before_after_policy": "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + "test_seam": "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口" + }, + { + "key": "schedule:cmd/worker/main.go:456:constants.TaskTypeOrderExpire", + "kind": "scheduled_job", + "code_entry": "cmd/worker/main.go:456", + "owner": "order_expire", + "summary": "按 @every 1m 调度 constants.TaskTypeOrderExpire", + "audit_event": "N/A", + "domain_ledger": "N/A", + "integration_log": "N/A", + "outbox": "N/A", + "actor_source": "system_task/scheduled_job", + "transaction": "N/A", + "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责", + "sensitive_policy": "调度日志仅记录任务类型与安全时间信息", + "before_after_policy": "N/A：调度入口不修改业务事实", + "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口", + "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker" + }, + { + "key": "schedule:cmd/worker/main.go:463:constants.TaskTypeAlertCheck", + "kind": "scheduled_job", + "code_entry": "cmd/worker/main.go:463", + "owner": "alert_check", + "summary": "按 @every 1m 调度 constants.TaskTypeAlertCheck", + "audit_event": "N/A", + "domain_ledger": "N/A", + "integration_log": "N/A", + "outbox": "N/A", + "actor_source": "system_task/scheduled_job", + "transaction": "N/A", + "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责", + "sensitive_policy": "调度日志仅记录任务类型与安全时间信息", + "before_after_policy": "N/A：调度入口不修改业务事实", + "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口", + "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker" + }, + { + "key": "schedule:cmd/worker/main.go:470:constants.TaskTypeDataCleanup", + "kind": "scheduled_job", + "code_entry": "cmd/worker/main.go:470", + "owner": "data_cleanup", + "summary": "按 0 2 * * * 调度 constants.TaskTypeDataCleanup", + "audit_event": "N/A", + "domain_ledger": "N/A", + "integration_log": "N/A", + "outbox": "N/A", + "actor_source": "system_task/scheduled_job", + "transaction": "N/A", + "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责", + "sensitive_policy": "调度日志仅记录任务类型与安全时间信息", + "before_after_policy": "N/A：调度入口不修改业务事实", + "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口", + "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker" + }, + { + "key": "schedule:cmd/worker/main.go:477:constants.TaskTypeDailyTrafficFlush", + "kind": "scheduled_job", + "code_entry": "cmd/worker/main.go:477", + "owner": "daily_traffic_flush", + "summary": "按 0 2 * * * 调度 constants.TaskTypeDailyTrafficFlush", + "audit_event": "N/A", + "domain_ledger": "N/A", + "integration_log": "N/A", + "outbox": "N/A", + "actor_source": "system_task/scheduled_job", + "transaction": "N/A", + "failure_strategy": "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责", + "sensitive_policy": "调度日志仅记录任务类型与安全时间信息", + "before_after_policy": "N/A：调度入口不修改业务事实", + "test_seam": "调度注册公开函数 + 覆盖门禁静态比对本入口", + "na_reason": "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker" + }, + { + "key": "service:internal/service/account/service.go:195:Update", + "kind": "service", + "code_entry": "internal/service/account/service.go:195 Update", + "owner": "account", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.update", + "action_name": "执行业务方法（Update）", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:296:Delete", + "kind": "service", + "code_entry": "internal/service/account/service.go:296 Delete", + "owner": "account", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.delete", + "action_name": "执行业务方法（Delete）", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:412:AssignRoles", + "kind": "service", + "code_entry": "internal/service/account/service.go:412 AssignRoles", + "owner": "account", + "summary": "业务方法 AssignRoles", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.assign_roles", + "action_name": "执行业务方法（AssignRoles）", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:563:RemoveRole", + "kind": "service", + "code_entry": "internal/service/account/service.go:563 RemoveRole", + "owner": "account", + "summary": "业务方法 RemoveRole", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.remove_role", + "action_name": "执行业务方法（RemoveRole）", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:62:Create", + "kind": "service", + "code_entry": "internal/service/account/service.go:62 Create", + "owner": "account", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.create", + "action_name": "执行业务方法（Create）", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:631:UpdatePassword", + "kind": "service", + "code_entry": "internal/service/account/service.go:631 UpdatePassword", + "owner": "account", + "summary": "业务方法 UpdatePassword", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.update_password", + "action_name": "执行业务方法（UpdatePassword）", + "category": "security", + "risk": "high", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:658:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/account/service.go:658 UpdateStatus", + "owner": "account", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/account/service.go:708:CreateSystemAccount", + "kind": "service", + "code_entry": "internal/service/account/service.go:708 CreateSystemAccount", + "owner": "account", + "summary": "业务方法 CreateSystemAccount", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "account.create_system_account", + "action_name": "执行业务方法（CreateSystemAccount）", + "category": "security", + "risk": "normal", + "primary_resource": "account", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_open_api/service.go:193:ResumeCard", + "kind": "service", + "code_entry": "internal/service/agent_open_api/service.go:193 ResumeCard", + "owner": "agent_open_api", + "summary": "业务方法 ResumeCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_open_api.resume_card", + "action_name": "执行业务方法（ResumeCard）", + "category": "business", + "risk": "normal", + "primary_resource": "agent_open_api", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_open_api/service.go:296:CreateWalletPackageOrders", + "kind": "service", + "code_entry": "internal/service/agent_open_api/service.go:296 CreateWalletPackageOrders", + "owner": "agent_open_api", + "summary": "业务方法 CreateWalletPackageOrders", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_open_api.create_wallet_package_orders", + "action_name": "执行业务方法（CreateWalletPackageOrders）", + "category": "business", + "risk": "high", + "primary_resource": "agent_open_api", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_open_api/service.go:470:ResetDevice", + "kind": "service", + "code_entry": "internal/service/agent_open_api/service.go:470 ResetDevice", + "owner": "agent_open_api", + "summary": "业务方法 ResetDevice", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_open_api.reset_device", + "action_name": "执行业务方法（ResetDevice）", + "category": "business", + "risk": "normal", + "primary_resource": "agent_open_api", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_recharge/service.go:296:HandlePaymentCallback", + "kind": "service", + "code_entry": "internal/service/agent_recharge/service.go:296 HandlePaymentCallback", + "owner": "agent_recharge", + "summary": "业务方法 HandlePaymentCallback", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_recharge.handle_payment_callback", + "action_name": "执行业务方法（HandlePaymentCallback）", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_recharge/service.go:392:Reject", + "kind": "service", + "code_entry": "internal/service/agent_recharge/service.go:392 Reject", + "owner": "agent_recharge", + "summary": "业务方法 Reject", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_recharge.reject", + "action_name": "执行业务方法（Reject）", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/agent_recharge/service.go:82:Create", + "kind": "service", + "code_entry": "internal/service/agent_recharge/service.go:82 Create", + "owner": "agent_recharge", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "agent_recharge.create", + "action_name": "执行业务方法（Create）", + "category": "finance", + "risk": "high", + "primary_resource": "agent_recharge", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/lifecycle_service.go:162:DeactivateDevice", + "kind": "service", + "code_entry": "internal/service/asset/lifecycle_service.go:162 DeactivateDevice", + "owner": "asset", + "summary": "业务方法 DeactivateDevice", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.deactivate_device", + "action_name": "执行业务方法（DeactivateDevice）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/lifecycle_service.go:54:DeactivateIotCard", + "kind": "service", + "code_entry": "internal/service/asset/lifecycle_service.go:54 DeactivateIotCard", + "owner": "asset", + "summary": "业务方法 DeactivateIotCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.deactivate_iot_card", + "action_name": "执行业务方法（DeactivateIotCard）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/service.go:108:Resolve", + "kind": "service", + "code_entry": "internal/service/asset/service.go:108 Resolve", + "owner": "asset", + "summary": "业务方法 Resolve", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.resolve", + "action_name": "执行业务方法（Resolve）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/service.go:609:Refresh", + "kind": "service", + "code_entry": "internal/service/asset/service.go:609 Refresh", + "owner": "asset", + "summary": "业务方法 Refresh", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.refresh", + "action_name": "执行业务方法（Refresh）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/service.go:60:SetPackageExpiryQuery", + "kind": "service", + "code_entry": "internal/service/asset/service.go:60 SetPackageExpiryQuery", + "owner": "asset", + "summary": "业务方法 SetPackageExpiryQuery", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.set_package_expiry_query", + "action_name": "执行业务方法（SetPackageExpiryQuery）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/service.go:903:UpdatePackageExpiresAt", + "kind": "service", + "code_entry": "internal/service/asset/service.go:903 UpdatePackageExpiresAt", + "owner": "asset", + "summary": "业务方法 UpdatePackageExpiresAt", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.update_package_expires_at", + "action_name": "执行业务方法（UpdatePackageExpiresAt）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/asset/service.go:948:UpdatePackageUsage", + "kind": "service", + "code_entry": "internal/service/asset/service.go:948 UpdatePackageUsage", + "owner": "asset", + "summary": "业务方法 UpdatePackageUsage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "asset.update_package_usage", + "action_name": "执行业务方法（UpdatePackageUsage）", + "category": "asset", + "risk": "normal", + "primary_resource": "asset", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/auth/service.go:140:Logout", + "kind": "service", + "code_entry": "internal/service/auth/service.go:140 Logout", + "owner": "auth", + "summary": "业务方法 Logout", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "auth.logout", + "action_name": "执行业务方法（Logout）", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/auth/service.go:154:RefreshToken", + "kind": "service", + "code_entry": "internal/service/auth/service.go:154 RefreshToken", + "owner": "auth", + "summary": "业务方法 RefreshToken", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "auth.refresh_token", + "action_name": "执行业务方法（RefreshToken）", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/auth/service.go:178:ChangePassword", + "kind": "service", + "code_entry": "internal/service/auth/service.go:178 ChangePassword", + "owner": "auth", + "summary": "业务方法 ChangePassword", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "auth.change_password", + "action_name": "执行业务方法（ChangePassword）", + "category": "security", + "risk": "high", + "primary_resource": "auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/auth/service.go:48:Login", + "kind": "service", + "code_entry": "internal/service/auth/service.go:48 Login", + "owner": "auth", + "summary": "业务方法 Login", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "auth.login", + "action_name": "执行业务方法（Login）", + "category": "security", + "risk": "normal", + "primary_resource": "auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/carrier/service.go:115:Delete", + "kind": "service", + "code_entry": "internal/service/carrier/service.go:115 Delete", + "owner": "carrier", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "carrier.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/carrier/service.go:168:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/carrier/service.go:168 UpdateStatus", + "owner": "carrier", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "carrier.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/carrier/service.go:26:Create", + "kind": "service", + "code_entry": "internal/service/carrier/service.go:26 Create", + "owner": "carrier", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "carrier.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/carrier/service.go:74:Update", + "kind": "service", + "code_entry": "internal/service/carrier/service.go:74 Update", + "owner": "carrier", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "carrier.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "carrier", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_auth/service.go:265:SendCode", + "kind": "service", + "code_entry": "internal/service/client_auth/service.go:265 SendCode", + "owner": "client_auth", + "summary": "业务方法 SendCode", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_auth.send_code", + "action_name": "执行业务方法（SendCode）", + "category": "security", + "risk": "normal", + "primary_resource": "client_auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_auth/service.go:289:BindPhone", + "kind": "service", + "code_entry": "internal/service/client_auth/service.go:289 BindPhone", + "owner": "client_auth", + "summary": "业务方法 BindPhone", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_auth.bind_phone", + "action_name": "执行业务方法（BindPhone）", + "category": "security", + "risk": "normal", + "primary_resource": "client_auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_auth/service.go:332:ChangePhone", + "kind": "service", + "code_entry": "internal/service/client_auth/service.go:332 ChangePhone", + "owner": "client_auth", + "summary": "业务方法 ChangePhone", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_auth.change_phone", + "action_name": "执行业务方法（ChangePhone）", + "category": "security", + "risk": "normal", + "primary_resource": "client_auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_auth/service.go:380:Logout", + "kind": "service", + "code_entry": "internal/service/client_auth/service.go:380 Logout", + "owner": "client_auth", + "summary": "业务方法 Logout", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_auth.logout", + "action_name": "执行业务方法（Logout）", + "category": "security", + "risk": "normal", + "primary_resource": "client_auth", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_order/payment_provider.go:39:CreateJSAPIPayment", + "kind": "service", + "code_entry": "internal/service/client_order/payment_provider.go:39 CreateJSAPIPayment", + "owner": "client_order", + "summary": "业务方法 CreateJSAPIPayment", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_order.create_j_s_a_p_i_payment", + "action_name": "执行业务方法（CreateJSAPIPayment）", + "category": "finance", + "risk": "normal", + "primary_resource": "client_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_order/payment_provider.go:53:CreateJSAPIPayment", + "kind": "service", + "code_entry": "internal/service/client_order/payment_provider.go:53 CreateJSAPIPayment", + "owner": "client_order", + "summary": "业务方法 CreateJSAPIPayment", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_order.create_j_s_a_p_i_payment", + "action_name": "执行业务方法（CreateJSAPIPayment）", + "category": "finance", + "risk": "normal", + "primary_resource": "client_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_order/payment_provider.go:69:CreateJSAPIPayment", + "kind": "service", + "code_entry": "internal/service/client_order/payment_provider.go:69 CreateJSAPIPayment", + "owner": "client_order", + "summary": "业务方法 CreateJSAPIPayment", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_order.create_j_s_a_p_i_payment", + "action_name": "执行业务方法（CreateJSAPIPayment）", + "category": "finance", + "risk": "normal", + "primary_resource": "client_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_order/service.go:1208:PayOrder", + "kind": "service", + "code_entry": "internal/service/client_order/service.go:1208 PayOrder", + "owner": "client_order", + "summary": "业务方法 PayOrder", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_order.pay_order", + "action_name": "执行业务方法（PayOrder）", + "category": "finance", + "risk": "normal", + "primary_resource": "client_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/client_order/service.go:122:CreateOrder", + "kind": "service", + "code_entry": "internal/service/client_order/service.go:122 CreateOrder", + "owner": "client_order", + "summary": "业务方法 CreateOrder", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "client_order.create_order", + "action_name": "执行业务方法（CreateOrder）", + "category": "finance", + "risk": "normal", + "primary_resource": "client_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_calculation/service.go:334:TriggerOneTimeCommissionForCard", + "kind": "service", + "code_entry": "internal/service/commission_calculation/service.go:334 TriggerOneTimeCommissionForCard", + "owner": "commission_calculation", + "summary": "业务方法 TriggerOneTimeCommissionForCard", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_calculation.trigger_one_time_commission_for_card", + "action_name": "执行业务方法（TriggerOneTimeCommissionForCard）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_calculation", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_calculation/service.go:413:TriggerOneTimeCommissionForDevice", + "kind": "service", + "code_entry": "internal/service/commission_calculation/service.go:413 TriggerOneTimeCommissionForDevice", + "owner": "commission_calculation", + "summary": "业务方法 TriggerOneTimeCommissionForDevice", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_calculation.trigger_one_time_commission_for_device", + "action_name": "执行业务方法（TriggerOneTimeCommissionForDevice）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_calculation", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_calculation/service.go:750:CreditCommission", + "kind": "service", + "code_entry": "internal/service/commission_calculation/service.go:750 CreditCommission", + "owner": "commission_calculation", + "summary": "业务方法 CreditCommission", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_calculation.credit_commission", + "action_name": "执行业务方法（CreditCommission）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_calculation", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_stats/service.go:37:UpdateStats", + "kind": "service", + "code_entry": "internal/service/commission_stats/service.go:37 UpdateStats", + "owner": "commission_stats", + "summary": "业务方法 UpdateStats", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_stats.update_stats", + "action_name": "执行业务方法（UpdateStats）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_stats", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_stats/service.go:64:ArchiveCompletedPeriod", + "kind": "service", + "code_entry": "internal/service/commission_stats/service.go:64 ArchiveCompletedPeriod", + "owner": "commission_stats", + "summary": "业务方法 ArchiveCompletedPeriod", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_stats.archive_completed_period", + "action_name": "执行业务方法（ArchiveCompletedPeriod）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_stats", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_withdrawal/service.go:145:Approve", + "kind": "service", + "code_entry": "internal/service/commission_withdrawal/service.go:145 Approve", + "owner": "commission_withdrawal", + "summary": "业务方法 Approve", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_withdrawal.approve", + "action_name": "执行业务方法（Approve）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_withdrawal", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_withdrawal/service.go:258:Reject", + "kind": "service", + "code_entry": "internal/service/commission_withdrawal/service.go:258 Reject", + "owner": "commission_withdrawal", + "summary": "业务方法 Reject", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_withdrawal.reject", + "action_name": "执行业务方法（Reject）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_withdrawal", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/commission_withdrawal_setting/service.go:35:Create", + "kind": "service", + "code_entry": "internal/service/commission_withdrawal_setting/service.go:35 Create", + "owner": "commission_withdrawal_setting", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "commission_withdrawal_setting.create", + "action_name": "执行业务方法（Create）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_withdrawal_setting", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/customer_binding/service.go:150:Bind", + "kind": "service", + "code_entry": "internal/service/customer_binding/service.go:150 Bind", + "owner": "customer_binding", + "summary": "业务方法 Bind", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "customer_binding.bind", + "action_name": "执行业务方法（Bind）", + "category": "business", + "risk": "normal", + "primary_resource": "customer_binding", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/customer_binding/service.go:253:Migrate", + "kind": "service", + "code_entry": "internal/service/customer_binding/service.go:253 Migrate", + "owner": "customer_binding", + "summary": "业务方法 Migrate", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "customer_binding.migrate", + "action_name": "执行业务方法（Migrate）", + "category": "business", + "risk": "normal", + "primary_resource": "customer_binding", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/binding.go:348:UnbindCard", + "kind": "service", + "code_entry": "internal/service/device/binding.go:348 UnbindCard", + "owner": "device", + "summary": "业务方法 UnbindCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.unbind_card", + "action_name": "执行业务方法（UnbindCard）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/binding.go:79:BindCard", + "kind": "service", + "code_entry": "internal/service/device/binding.go:79 BindCard", + "owner": "device", + "summary": "业务方法 BindCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.bind_card", + "action_name": "执行业务方法（BindCard）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:1090:BatchSetSeriesBinding", + "kind": "service", + "code_entry": "internal/service/device/service.go:1090 BatchSetSeriesBinding", + "owner": "device", + "summary": "业务方法 BatchSetSeriesBinding", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.batch_set_series_binding", + "action_name": "执行业务方法（BatchSetSeriesBinding）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:1513:StopDevice", + "kind": "service", + "code_entry": "internal/service/device/service.go:1513 StopDevice", + "owner": "device", + "summary": "业务方法 StopDevice", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.stop_device", + "action_name": "执行业务方法（StopDevice）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:1982:UpdateRealnamePolicy", + "kind": "service", + "code_entry": "internal/service/device/service.go:1982 UpdateRealnamePolicy", + "owner": "device", + "summary": "业务方法 UpdateRealnamePolicy", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.update_realname_policy", + "action_name": "执行业务方法（UpdateRealnamePolicy）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:320:Delete", + "kind": "service", + "code_entry": "internal/service/device/service.go:320 Delete", + "owner": "device", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.delete", + "action_name": "执行业务方法（Delete）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:434:AllocateDevices", + "kind": "service", + "code_entry": "internal/service/device/service.go:434 AllocateDevices", + "owner": "device", + "summary": "业务方法 AllocateDevices", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.allocate_devices", + "action_name": "执行业务方法（AllocateDevices）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:43:SetPackageExpiryQuery", + "kind": "service", + "code_entry": "internal/service/device/service.go:43 SetPackageExpiryQuery", + "owner": "device", + "summary": "业务方法 SetPackageExpiryQuery", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.set_package_expiry_query", + "action_name": "执行业务方法（SetPackageExpiryQuery）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device/service.go:640:RecallDevices", + "kind": "service", + "code_entry": "internal/service/device/service.go:640 RecallDevices", + "owner": "device", + "summary": "业务方法 RecallDevices", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device.recall_devices", + "action_name": "执行业务方法（RecallDevices）", + "category": "asset", + "risk": "normal", + "primary_resource": "device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/device_import/service.go:45:CreateImportTask", + "kind": "service", + "code_entry": "internal/service/device_import/service.go:45 CreateImportTask", + "owner": "device_import", + "summary": "业务方法 CreateImportTask", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "device_import.create_import_task", + "action_name": "执行业务方法（CreateImportTask）", + "category": "asset", + "risk": "normal", + "primary_resource": "device_import", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/email/service.go:32:SendWelcomeEmail", + "kind": "service", + "code_entry": "internal/service/email/service.go:32 SendWelcomeEmail", + "owner": "email", + "summary": "业务方法 SendWelcomeEmail", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "email.send_welcome_email", + "action_name": "执行业务方法（SendWelcomeEmail）", + "category": "business", + "risk": "normal", + "primary_resource": "email", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/email/service.go:66:SendPasswordResetEmail", + "kind": "service", + "code_entry": "internal/service/email/service.go:66 SendPasswordResetEmail", + "owner": "email", + "summary": "业务方法 SendPasswordResetEmail", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "email.send_password_reset_email", + "action_name": "执行业务方法（SendPasswordResetEmail）", + "category": "business", + "risk": "high", + "primary_resource": "email", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/email/service.go:98:SendNotificationEmail", + "kind": "service", + "code_entry": "internal/service/email/service.go:98 SendNotificationEmail", + "owner": "email", + "summary": "业务方法 SendNotificationEmail", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "email.send_notification_email", + "action_name": "执行业务方法（SendNotificationEmail）", + "category": "business", + "risk": "normal", + "primary_resource": "email", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise/service.go:142:Update", + "kind": "service", + "code_entry": "internal/service/enterprise/service.go:142 Update", + "owner": "enterprise", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise/service.go:202:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/enterprise/service.go:202 UpdateStatus", + "owner": "enterprise", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise/service.go:233:UpdatePassword", + "kind": "service", + "code_entry": "internal/service/enterprise/service.go:233 UpdatePassword", + "owner": "enterprise", + "summary": "业务方法 UpdatePassword", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise.update_password", + "action_name": "执行业务方法（UpdatePassword）", + "category": "business", + "risk": "high", + "primary_resource": "enterprise", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise/service.go:33:Create", + "kind": "service", + "code_entry": "internal/service/enterprise/service.go:33 Create", + "owner": "enterprise", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "enterprise", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/authorization_service.go:146:RevokeAuthorizations", + "kind": "service", + "code_entry": "internal/service/enterprise_card/authorization_service.go:146 RevokeAuthorizations", + "owner": "enterprise_card", + "summary": "业务方法 RevokeAuthorizations", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.revoke_authorizations", + "action_name": "执行业务方法（RevokeAuthorizations）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/authorization_service.go:401:UpdateRecordRemark", + "kind": "service", + "code_entry": "internal/service/enterprise_card/authorization_service.go:401 UpdateRecordRemark", + "owner": "enterprise_card", + "summary": "业务方法 UpdateRecordRemark", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.update_record_remark", + "action_name": "执行业务方法（UpdateRecordRemark）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/authorization_service.go:46:BatchAuthorize", + "kind": "service", + "code_entry": "internal/service/enterprise_card/authorization_service.go:46 BatchAuthorize", + "owner": "enterprise_card", + "summary": "业务方法 BatchAuthorize", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.batch_authorize", + "action_name": "执行业务方法（BatchAuthorize）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/service.go:201:AllocateCards", + "kind": "service", + "code_entry": "internal/service/enterprise_card/service.go:201 AllocateCards", + "owner": "enterprise_card", + "summary": "业务方法 AllocateCards", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.allocate_cards", + "action_name": "执行业务方法（AllocateCards）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/service.go:286:RecallCards", + "kind": "service", + "code_entry": "internal/service/enterprise_card/service.go:286 RecallCards", + "owner": "enterprise_card", + "summary": "业务方法 RecallCards", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.recall_cards", + "action_name": "执行业务方法（RecallCards）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/service.go:37:AllocateCardsPreview", + "kind": "service", + "code_entry": "internal/service/enterprise_card/service.go:37 AllocateCardsPreview", + "owner": "enterprise_card", + "summary": "业务方法 AllocateCardsPreview", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.allocate_cards_preview", + "action_name": "执行业务方法（AllocateCardsPreview）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_card/service.go:482:ResumeCard", + "kind": "service", + "code_entry": "internal/service/enterprise_card/service.go:482 ResumeCard", + "owner": "enterprise_card", + "summary": "业务方法 ResumeCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_card.resume_card", + "action_name": "执行业务方法（ResumeCard）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_device/service.go:332:RecallDevices", + "kind": "service", + "code_entry": "internal/service/enterprise_device/service.go:332 RecallDevices", + "owner": "enterprise_device", + "summary": "业务方法 RecallDevices", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_device.recall_devices", + "action_name": "执行业务方法（RecallDevices）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/enterprise_device/service.go:50:AllocateDevices", + "kind": "service", + "code_entry": "internal/service/enterprise_device/service.go:50 AllocateDevices", + "owner": "enterprise_device", + "summary": "业务方法 AllocateDevices", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "enterprise_device.allocate_devices", + "action_name": "执行业务方法（AllocateDevices）", + "category": "asset", + "risk": "normal", + "primary_resource": "enterprise_device", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/exchange/service.go:178:Cancel", + "kind": "service", + "code_entry": "internal/service/exchange/service.go:178 Cancel", + "owner": "exchange", + "summary": "业务方法 Cancel", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "exchange.cancel", + "action_name": "执行业务方法（Cancel）", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/exchange/service.go:340:SubmitShippingInfo", + "kind": "service", + "code_entry": "internal/service/exchange/service.go:340 SubmitShippingInfo", + "owner": "exchange", + "summary": "业务方法 SubmitShippingInfo", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "exchange.submit_shipping_info", + "action_name": "执行业务方法（SubmitShippingInfo）", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/exchange/service.go:62:Create", + "kind": "service", + "code_entry": "internal/service/exchange/service.go:62 Create", + "owner": "exchange", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "exchange.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "exchange", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/export_task/service.go:222:CancelTask", + "kind": "service", + "code_entry": "internal/service/export_task/service.go:222 CancelTask", + "owner": "export_task", + "summary": "业务方法 CancelTask", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "export_task.cancel_task", + "action_name": "执行业务方法（CancelTask）", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/export_task/service.go:49:CreateTask", + "kind": "service", + "code_entry": "internal/service/export_task/service.go:49 CreateTask", + "owner": "export_task", + "summary": "业务方法 CreateTask", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "export_task.create_task", + "action_name": "执行业务方法（CreateTask）", + "category": "business", + "risk": "normal", + "primary_resource": "export_task", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1101:BatchSetSeriesBinding", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1101 BatchSetSeriesBinding", + "owner": "iot_card", + "summary": "业务方法 BatchSetSeriesBinding", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.batch_set_series_binding", + "action_name": "执行业务方法（BatchSetSeriesBinding）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:113:SetPollingCallback", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:113 SetPollingCallback", + "owner": "iot_card", + "summary": "业务方法 SetPollingCallback", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_polling_callback", + "action_name": "执行业务方法（SetPollingCallback）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:118:SetAssetIdentifierStore", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:118 SetAssetIdentifierStore", + "owner": "iot_card", + "summary": "业务方法 SetAssetIdentifierStore", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_asset_identifier_store", + "action_name": "执行业务方法（SetAssetIdentifierStore）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:123:SetEnterpriseCardAuthStore", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:123 SetEnterpriseCardAuthStore", + "owner": "iot_card", + "summary": "业务方法 SetEnterpriseCardAuthStore", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_enterprise_card_auth_store", + "action_name": "执行业务方法（SetEnterpriseCardAuthStore）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:128:SetEnterpriseStore", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:128 SetEnterpriseStore", + "owner": "iot_card", + "summary": "业务方法 SetEnterpriseStore", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_enterprise_store", + "action_name": "执行业务方法（SetEnterpriseStore）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:134:SetDataDeductor", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:134 SetDataDeductor", + "owner": "iot_card", + "summary": "业务方法 SetDataDeductor", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_data_deductor", + "action_name": "执行业务方法（SetDataDeductor）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:140:SetRealnameActivator", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:140 SetRealnameActivator", + "owner": "iot_card", + "summary": "业务方法 SetRealnameActivator", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_realname_activator", + "action_name": "执行业务方法（SetRealnameActivator）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:146:SetStopResumeService", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:146 SetStopResumeService", + "owner": "iot_card", + "summary": "业务方法 SetStopResumeService", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_stop_resume_service", + "action_name": "执行业务方法（SetStopResumeService）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1516:RefreshCardDataByID", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1516 RefreshCardDataByID", + "owner": "iot_card", + "summary": "业务方法 RefreshCardDataByID", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.refresh_card_data_by_i_d", + "action_name": "执行业务方法（RefreshCardDataByID）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:152:SetDeviceSimBindingStore", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:152 SetDeviceSimBindingStore", + "owner": "iot_card", + "summary": "业务方法 SetDeviceSimBindingStore", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_device_sim_binding_store", + "action_name": "执行业务方法（SetDeviceSimBindingStore）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1530:RefreshCardDataFromGateway", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1530 RefreshCardDataFromGateway", + "owner": "iot_card", + "summary": "业务方法 RefreshCardDataFromGateway", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.refresh_card_data_from_gateway", + "action_name": "执行业务方法（RefreshCardDataFromGateway）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:158:SetRedisClient", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:158 SetRedisClient", + "owner": "iot_card", + "summary": "业务方法 SetRedisClient", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_redis_client", + "action_name": "执行业务方法（SetRedisClient）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1734:UpdatePollingStatus", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1734 UpdatePollingStatus", + "owner": "iot_card", + "summary": "业务方法 UpdatePollingStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.update_polling_status", + "action_name": "执行业务方法（UpdatePollingStatus）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1841:BatchUpdatePollingStatus", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1841 BatchUpdatePollingStatus", + "owner": "iot_card", + "summary": "业务方法 BatchUpdatePollingStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.batch_update_polling_status", + "action_name": "执行业务方法（BatchUpdatePollingStatus）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1899:DeleteCard", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1899 DeleteCard", + "owner": "iot_card", + "summary": "业务方法 DeleteCard", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.delete_card", + "action_name": "执行业务方法（DeleteCard）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:1968:BatchDeleteCards", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:1968 BatchDeleteCards", + "owner": "iot_card", + "summary": "业务方法 BatchDeleteCards", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.batch_delete_cards", + "action_name": "执行业务方法（BatchDeleteCards）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:2039:UpdateRealnamePolicy", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:2039 UpdateRealnamePolicy", + "owner": "iot_card", + "summary": "业务方法 UpdateRealnamePolicy", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.update_realname_policy", + "action_name": "执行业务方法（UpdateRealnamePolicy）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:508:AllocateCards", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:508 AllocateCards", + "owner": "iot_card", + "summary": "业务方法 AllocateCards", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.allocate_cards", + "action_name": "执行业务方法（AllocateCards）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:702:RecallCards", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:702 RecallCards", + "owner": "iot_card", + "summary": "业务方法 RecallCards", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.recall_cards", + "action_name": "执行业务方法（RecallCards）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/service.go:81:SetPackageExpiryQuery", + "kind": "service", + "code_entry": "internal/service/iot_card/service.go:81 SetPackageExpiryQuery", + "owner": "iot_card", + "summary": "业务方法 SetPackageExpiryQuery", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_package_expiry_query", + "action_name": "执行业务方法（SetPackageExpiryQuery）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/stop_resume_service.go:373:ResumeCardIfStopped", + "kind": "service", + "code_entry": "internal/service/iot_card/stop_resume_service.go:373 ResumeCardIfStopped", + "owner": "iot_card", + "summary": "业务方法 ResumeCardIfStopped", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.resume_card_if_stopped", + "action_name": "执行业务方法（ResumeCardIfStopped）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card/stop_resume_service.go:72:SetPollingCallback", + "kind": "service", + "code_entry": "internal/service/iot_card/stop_resume_service.go:72 SetPollingCallback", + "owner": "iot_card", + "summary": "业务方法 SetPollingCallback", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card.set_polling_callback", + "action_name": "执行业务方法（SetPollingCallback）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/iot_card_import/service.go:67:CreateImportTask", + "kind": "service", + "code_entry": "internal/service/iot_card_import/service.go:67 CreateImportTask", + "owner": "iot_card_import", + "summary": "业务方法 CreateImportTask", + "audit_event": "必须", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "iot_card_import.create_import_task", + "action_name": "执行业务方法（CreateImportTask）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card_import", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/operation_password/service.go:27:Set", + "kind": "service", + "code_entry": "internal/service/operation_password/service.go:27 Set", + "owner": "operation_password", + "summary": "业务方法 Set", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "operation_password.set", + "action_name": "执行业务方法（Set）", + "category": "business", + "risk": "high", + "primary_resource": "operation_password", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:118:SetResumeCallback", + "kind": "service", + "code_entry": "internal/service/order/service.go:118 SetResumeCallback", + "owner": "order", + "summary": "业务方法 SetResumeCallback", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.set_resume_callback", + "action_name": "执行业务方法（SetResumeCallback）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:125:CreateAdminOrder", + "kind": "service", + "code_entry": "internal/service/order/service.go:125 CreateAdminOrder", + "owner": "order", + "summary": "业务方法 CreateAdminOrder", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.create_admin_order", + "action_name": "执行业务方法（CreateAdminOrder）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:1390:Cancel", + "kind": "service", + "code_entry": "internal/service/order/service.go:1390 Cancel", + "owner": "order", + "summary": "业务方法 Cancel", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.cancel", + "action_name": "执行业务方法（Cancel）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:1412:CancelExpiredOrders", + "kind": "service", + "code_entry": "internal/service/order/service.go:1412 CancelExpiredOrders", + "owner": "order", + "summary": "业务方法 CancelExpiredOrders", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.cancel_expired_orders", + "action_name": "执行业务方法（CancelExpiredOrders）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:1763:HandlePaymentCallback", + "kind": "service", + "code_entry": "internal/service/order/service.go:1763 HandlePaymentCallback", + "owner": "order", + "summary": "业务方法 HandlePaymentCallback", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.handle_payment_callback", + "action_name": "执行业务方法（HandlePaymentCallback）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:1830:HandlePaymentRecordCallback", + "kind": "service", + "code_entry": "internal/service/order/service.go:1830 HandlePaymentRecordCallback", + "owner": "order", + "summary": "业务方法 HandlePaymentRecordCallback", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.handle_payment_record_callback", + "action_name": "执行业务方法（HandlePaymentRecordCallback）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order/service.go:522:CreateH5Order", + "kind": "service", + "code_entry": "internal/service/order/service.go:522 CreateH5Order", + "owner": "order", + "summary": "业务方法 CreateH5Order", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order.create_h5_order", + "action_name": "执行业务方法（CreateH5Order）", + "category": "finance", + "risk": "normal", + "primary_resource": "order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/order_package_invalidate/service.go:43:Create", + "kind": "service", + "code_entry": "internal/service/order_package_invalidate/service.go:43 Create", + "owner": "order_package_invalidate", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "order_package_invalidate.create", + "action_name": "执行业务方法（Create）", + "category": "finance", + "risk": "normal", + "primary_resource": "order_package_invalidate", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:174:ActivateQueuedPackage", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:174 ActivateQueuedPackage", + "owner": "package", + "summary": "业务方法 ActivateQueuedPackage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.activate_queued_package", + "action_name": "执行业务方法（ActivateQueuedPackage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:235:ActivateSpecificPackage", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:235 ActivateSpecificPackage", + "owner": "package", + "summary": "业务方法 ActivateSpecificPackage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.activate_specific_package", + "action_name": "执行业务方法（ActivateSpecificPackage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:345:ActivateNextPendingMainPackage", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:345 ActivateNextPendingMainPackage", + "owner": "package", + "summary": "业务方法 ActivateNextPendingMainPackage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.activate_next_pending_main_package", + "action_name": "执行业务方法（ActivateNextPendingMainPackage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:52:SetResumeCallback", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:52 SetResumeCallback", + "owner": "package", + "summary": "业务方法 SetResumeCallback", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.set_resume_callback", + "action_name": "执行业务方法（SetResumeCallback）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:58:ActivateByRealname", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:58 ActivateByRealname", + "owner": "package", + "summary": "业务方法 ActivateByRealname", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.activate_by_realname", + "action_name": "执行业务方法（ActivateByRealname）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:650:InvalidatePackagesForRefund", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:650 InvalidatePackagesForRefund", + "owner": "package", + "summary": "业务方法 InvalidatePackagesForRefund", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.invalidate_packages_for_refund", + "action_name": "执行业务方法（InvalidatePackagesForRefund）", + "category": "business", + "risk": "high", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/activation_service.go:781:InvalidateAllPackagesByAsset", + "kind": "service", + "code_entry": "internal/service/package/activation_service.go:781 InvalidateAllPackagesByAsset", + "owner": "package", + "summary": "业务方法 InvalidateAllPackagesByAsset", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.invalidate_all_packages_by_asset", + "action_name": "执行业务方法（InvalidateAllPackagesByAsset）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/reset_service.go:106:ResetMonthlyUsage", + "kind": "service", + "code_entry": "internal/service/package/reset_service.go:106 ResetMonthlyUsage", + "owner": "package", + "summary": "业务方法 ResetMonthlyUsage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.reset_monthly_usage", + "action_name": "执行业务方法（ResetMonthlyUsage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/reset_service.go:182:ResetYearlyUsage", + "kind": "service", + "code_entry": "internal/service/package/reset_service.go:182 ResetYearlyUsage", + "owner": "package", + "summary": "业务方法 ResetYearlyUsage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.reset_yearly_usage", + "action_name": "执行业务方法（ResetYearlyUsage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/reset_service.go:39:SetResumeCallback", + "kind": "service", + "code_entry": "internal/service/package/reset_service.go:39 SetResumeCallback", + "owner": "package", + "summary": "业务方法 SetResumeCallback", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.set_resume_callback", + "action_name": "执行业务方法（SetResumeCallback）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/reset_service.go:44:ResetDailyUsage", + "kind": "service", + "code_entry": "internal/service/package/reset_service.go:44 ResetDailyUsage", + "owner": "package", + "summary": "业务方法 ResetDailyUsage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.reset_daily_usage", + "action_name": "执行业务方法（ResetDailyUsage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:194:Update", + "kind": "service", + "code_entry": "internal/service/package/service.go:194 Update", + "owner": "package", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:317:Delete", + "kind": "service", + "code_entry": "internal/service/package/service.go:317 Delete", + "owner": "package", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:41:Create", + "kind": "service", + "code_entry": "internal/service/package/service.go:41 Create", + "owner": "package", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:447:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/package/service.go:447 UpdateStatus", + "owner": "package", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:475:UpdateShelfStatus", + "kind": "service", + "code_entry": "internal/service/package/service.go:475 UpdateShelfStatus", + "owner": "package", + "summary": "业务方法 UpdateShelfStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.update_shelf_status", + "action_name": "执行业务方法（UpdateShelfStatus）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/service.go:512:UpdateRetailPrice", + "kind": "service", + "code_entry": "internal/service/package/service.go:512 UpdateRetailPrice", + "owner": "package", + "summary": "业务方法 UpdateRetailPrice", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.update_retail_price", + "action_name": "执行业务方法（UpdateRetailPrice）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/usage_service.go:63:SetStopResumeCallback", + "kind": "service", + "code_entry": "internal/service/package/usage_service.go:63 SetStopResumeCallback", + "owner": "package", + "summary": "业务方法 SetStopResumeCallback", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.set_stop_resume_callback", + "action_name": "执行业务方法（SetStopResumeCallback）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package/usage_service.go:71:DeductDataUsage", + "kind": "service", + "code_entry": "internal/service/package/usage_service.go:71 DeductDataUsage", + "owner": "package", + "summary": "业务方法 DeductDataUsage", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package.deduct_data_usage", + "action_name": "执行业务方法（DeductDataUsage）", + "category": "business", + "risk": "normal", + "primary_resource": "package", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package_series/service.go:138:Delete", + "kind": "service", + "code_entry": "internal/service/package_series/service.go:138 Delete", + "owner": "package_series", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package_series.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package_series/service.go:226:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/package_series/service.go:226 UpdateStatus", + "owner": "package_series", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package_series.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package_series/service.go:35:Create", + "kind": "service", + "code_entry": "internal/service/package_series/service.go:35 Create", + "owner": "package_series", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package_series.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/package_series/service.go:90:Update", + "kind": "service", + "code_entry": "internal/service/package_series/service.go:90 Update", + "owner": "package_series", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "package_series.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "package_series", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/permission/service.go:119:Update", + "kind": "service", + "code_entry": "internal/service/permission/service.go:119 Update", + "owner": "permission", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "permission.update", + "action_name": "执行业务方法（Update）", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/permission/service.go:182:Delete", + "kind": "service", + "code_entry": "internal/service/permission/service.go:182 Delete", + "owner": "permission", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "permission.delete", + "action_name": "执行业务方法（Delete）", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/permission/service.go:56:Create", + "kind": "service", + "code_entry": "internal/service/permission/service.go:56 Create", + "owner": "permission", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "permission.create", + "action_name": "执行业务方法（Create）", + "category": "security", + "risk": "high", + "primary_resource": "permission", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/personal_customer/service.go:35:UpdateProfile", + "kind": "service", + "code_entry": "internal/service/personal_customer/service.go:35 UpdateProfile", + "owner": "personal_customer", + "summary": "业务方法 UpdateProfile", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "personal_customer.update_profile", + "action_name": "执行业务方法（UpdateProfile）", + "category": "business", + "risk": "normal", + "primary_resource": "personal_customer", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/alert_service.go:112:DeleteRule", + "kind": "service", + "code_entry": "internal/service/polling/alert_service.go:112 DeleteRule", + "owner": "polling", + "summary": "业务方法 DeleteRule", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.delete_rule", + "action_name": "执行业务方法（DeleteRule）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/alert_service.go:46:CreateRule", + "kind": "service", + "code_entry": "internal/service/polling/alert_service.go:46 CreateRule", + "owner": "polling", + "summary": "业务方法 CreateRule", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.create_rule", + "action_name": "执行业务方法（CreateRule）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/alert_service.go:83:UpdateRule", + "kind": "service", + "code_entry": "internal/service/polling/alert_service.go:83 UpdateRule", + "owner": "polling", + "summary": "业务方法 UpdateRule", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update_rule", + "action_name": "执行业务方法（UpdateRule）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/asset_polling_service.go:64:UpdatePollingStatus", + "kind": "service", + "code_entry": "internal/service/polling/asset_polling_service.go:64 UpdatePollingStatus", + "owner": "polling", + "summary": "业务方法 UpdatePollingStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update_polling_status", + "action_name": "执行业务方法（UpdatePollingStatus）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/cleanup_service.go:192:TriggerCleanup", + "kind": "service", + "code_entry": "internal/service/polling/cleanup_service.go:192 TriggerCleanup", + "owner": "polling", + "summary": "业务方法 TriggerCleanup", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.trigger_cleanup", + "action_name": "执行业务方法（TriggerCleanup）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/cleanup_service.go:38:CreateConfig", + "kind": "service", + "code_entry": "internal/service/polling/cleanup_service.go:38 CreateConfig", + "owner": "polling", + "summary": "业务方法 CreateConfig", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.create_config", + "action_name": "执行业务方法（CreateConfig）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/cleanup_service.go:67:UpdateConfig", + "kind": "service", + "code_entry": "internal/service/polling/cleanup_service.go:67 UpdateConfig", + "owner": "polling", + "summary": "业务方法 UpdateConfig", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update_config", + "action_name": "执行业务方法（UpdateConfig）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/cleanup_service.go:98:DeleteConfig", + "kind": "service", + "code_entry": "internal/service/polling/cleanup_service.go:98 DeleteConfig", + "owner": "polling", + "summary": "业务方法 DeleteConfig", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.delete_config", + "action_name": "执行业务方法（DeleteConfig）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/concurrency_service.go:109:UpdateMaxConcurrency", + "kind": "service", + "code_entry": "internal/service/polling/concurrency_service.go:109 UpdateMaxConcurrency", + "owner": "polling", + "summary": "业务方法 UpdateMaxConcurrency", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update_max_concurrency", + "action_name": "执行业务方法（UpdateMaxConcurrency）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/concurrency_service.go:136:ResetConcurrency", + "kind": "service", + "code_entry": "internal/service/polling/concurrency_service.go:136 ResetConcurrency", + "owner": "polling", + "summary": "业务方法 ResetConcurrency", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.reset_concurrency", + "action_name": "执行业务方法（ResetConcurrency）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/concurrency_service.go:171:SyncConfigToRedis", + "kind": "service", + "code_entry": "internal/service/polling/concurrency_service.go:171 SyncConfigToRedis", + "owner": "polling", + "summary": "业务方法 SyncConfigToRedis", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.sync_config_to_redis", + "action_name": "执行业务方法（SyncConfigToRedis）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/config_service.go:163:Delete", + "kind": "service", + "code_entry": "internal/service/polling/config_service.go:163 Delete", + "owner": "polling", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.delete", + "action_name": "执行业务方法（Delete）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/config_service.go:225:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/polling/config_service.go:225 UpdateStatus", + "owner": "polling", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/config_service.go:42:Create", + "kind": "service", + "code_entry": "internal/service/polling/config_service.go:42 Create", + "owner": "polling", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.create", + "action_name": "执行业务方法（Create）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/config_service.go:99:Update", + "kind": "service", + "code_entry": "internal/service/polling/config_service.go:99 Update", + "owner": "polling", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.update", + "action_name": "执行业务方法（Update）", + "category": "asset", + "risk": "high", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/manual_trigger_service.go:124:TriggerBatch", + "kind": "service", + "code_entry": "internal/service/polling/manual_trigger_service.go:124 TriggerBatch", + "owner": "polling", + "summary": "业务方法 TriggerBatch", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.trigger_batch", + "action_name": "执行业务方法（TriggerBatch）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/manual_trigger_service.go:233:TriggerByCondition", + "kind": "service", + "code_entry": "internal/service/polling/manual_trigger_service.go:233 TriggerByCondition", + "owner": "polling", + "summary": "业务方法 TriggerByCondition", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.trigger_by_condition", + "action_name": "执行业务方法（TriggerByCondition）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/manual_trigger_service.go:337:CancelTrigger", + "kind": "service", + "code_entry": "internal/service/polling/manual_trigger_service.go:337 CancelTrigger", + "owner": "polling", + "summary": "业务方法 CancelTrigger", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.cancel_trigger", + "action_name": "执行业务方法（CancelTrigger）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/polling/manual_trigger_service.go:42:TriggerSingle", + "kind": "service", + "code_entry": "internal/service/polling/manual_trigger_service.go:42 TriggerSingle", + "owner": "polling", + "summary": "业务方法 TriggerSingle", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "polling.trigger_single", + "action_name": "执行业务方法（TriggerSingle）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/recharge_order/service.go:63:HandlePaymentCallback", + "kind": "service", + "code_entry": "internal/service/recharge_order/service.go:63 HandlePaymentCallback", + "owner": "recharge_order", + "summary": "业务方法 HandlePaymentCallback", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "recharge_order.handle_payment_callback", + "action_name": "执行业务方法（HandlePaymentCallback）", + "category": "finance", + "risk": "high", + "primary_resource": "recharge_order", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/refund/service.go:198:Approve", + "kind": "service", + "code_entry": "internal/service/refund/service.go:198 Approve", + "owner": "refund", + "summary": "业务方法 Approve", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "refund.approve", + "action_name": "执行业务方法（Approve）", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/refund/service.go:528:Reject", + "kind": "service", + "code_entry": "internal/service/refund/service.go:528 Reject", + "owner": "refund", + "summary": "业务方法 Reject", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "refund.reject", + "action_name": "执行业务方法（Reject）", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/refund/service.go:82:Create", + "kind": "service", + "code_entry": "internal/service/refund/service.go:82 Create", + "owner": "refund", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "refund.create", + "action_name": "执行业务方法（Create）", + "category": "finance", + "risk": "high", + "primary_resource": "refund", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:132:Delete", + "kind": "service", + "code_entry": "internal/service/role/service.go:132 Delete", + "owner": "role", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.delete", + "action_name": "执行业务方法（Delete）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:191:AssignPermissions", + "kind": "service", + "code_entry": "internal/service/role/service.go:191 AssignPermissions", + "owner": "role", + "summary": "业务方法 AssignPermissions", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.assign_permissions", + "action_name": "执行业务方法（AssignPermissions）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:282:RemovePermission", + "kind": "service", + "code_entry": "internal/service/role/service.go:282 RemovePermission", + "owner": "role", + "summary": "业务方法 RemovePermission", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.remove_permission", + "action_name": "执行业务方法（RemovePermission）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:299:BatchRemovePermissions", + "kind": "service", + "code_entry": "internal/service/role/service.go:299 BatchRemovePermissions", + "owner": "role", + "summary": "业务方法 BatchRemovePermissions", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.batch_remove_permissions", + "action_name": "执行业务方法（BatchRemovePermissions）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:317:UpdateStatus", + "kind": "service", + "code_entry": "internal/service/role/service.go:317 UpdateStatus", + "owner": "role", + "summary": "业务方法 UpdateStatus", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.update_status", + "action_name": "执行业务方法（UpdateStatus）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:42:Create", + "kind": "service", + "code_entry": "internal/service/role/service.go:42 Create", + "owner": "role", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.create", + "action_name": "执行业务方法（Create）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/role/service.go:86:Update", + "kind": "service", + "code_entry": "internal/service/role/service.go:86 Update", + "owner": "role", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "role.update", + "action_name": "执行业务方法（Update）", + "category": "security", + "risk": "high", + "primary_resource": "role", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/service.go:202:Update", + "kind": "service", + "code_entry": "internal/service/shop/service.go:202 Update", + "owner": "shop", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/service.go:256:Disable", + "kind": "service", + "code_entry": "internal/service/shop/service.go:256 Disable", + "owner": "shop", + "summary": "业务方法 Disable", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.disable", + "action_name": "执行业务方法（Disable）", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/service.go:277:Enable", + "kind": "service", + "code_entry": "internal/service/shop/service.go:277 Enable", + "owner": "shop", + "summary": "业务方法 Enable", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.enable", + "action_name": "执行业务方法（Enable）", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/service.go:44:Create", + "kind": "service", + "code_entry": "internal/service/shop/service.go:44 Create", + "owner": "shop", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/service.go:452:Delete", + "kind": "service", + "code_entry": "internal/service/shop/service.go:452 Delete", + "owner": "shop", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "normal", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/shop_role.go:130:DeleteShopRole", + "kind": "service", + "code_entry": "internal/service/shop/shop_role.go:130 DeleteShopRole", + "owner": "shop", + "summary": "业务方法 DeleteShopRole", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.delete_shop_role", + "action_name": "执行业务方法（DeleteShopRole）", + "category": "business", + "risk": "high", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop/shop_role.go:13:AssignRolesToShop", + "kind": "service", + "code_entry": "internal/service/shop/shop_role.go:13 AssignRolesToShop", + "owner": "shop", + "summary": "业务方法 AssignRolesToShop", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop.assign_roles_to_shop", + "action_name": "执行业务方法（AssignRolesToShop）", + "category": "business", + "risk": "high", + "primary_resource": "shop", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_commission/service.go:546:CreateWithdrawalRequest", + "kind": "service", + "code_entry": "internal/service/shop_commission/service.go:546 CreateWithdrawalRequest", + "owner": "shop_commission", + "summary": "业务方法 CreateWithdrawalRequest", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_commission.create_withdrawal_request", + "action_name": "执行业务方法（CreateWithdrawalRequest）", + "category": "finance", + "risk": "normal", + "primary_resource": "shop_commission", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_commission/service.go:762:ResolveCommissionRecord", + "kind": "service", + "code_entry": "internal/service/shop_commission/service.go:762 ResolveCommissionRecord", + "owner": "shop_commission", + "summary": "业务方法 ResolveCommissionRecord", + "audit_event": "必须", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_commission.resolve_commission_record", + "action_name": "执行业务方法（ResolveCommissionRecord）", + "category": "finance", + "risk": "normal", + "primary_resource": "shop_commission", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_package_batch_allocation/service.go:104:BatchAllocate", + "kind": "service", + "code_entry": "internal/service/shop_package_batch_allocation/service.go:104 BatchAllocate", + "owner": "shop_package_batch_allocation", + "summary": "业务方法 BatchAllocate", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_package_batch_allocation.batch_allocate", + "action_name": "执行业务方法（BatchAllocate）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_allocation", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_package_batch_allocation/service.go:50:UpdateExpiryBase", + "kind": "service", + "code_entry": "internal/service/shop_package_batch_allocation/service.go:50 UpdateExpiryBase", + "owner": "shop_package_batch_allocation", + "summary": "业务方法 UpdateExpiryBase", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_package_batch_allocation.update_expiry_base", + "action_name": "执行业务方法（UpdateExpiryBase）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_allocation", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_package_batch_pricing/service.go:37:BatchUpdatePricing", + "kind": "service", + "code_entry": "internal/service/shop_package_batch_pricing/service.go:37 BatchUpdatePricing", + "owner": "shop_package_batch_pricing", + "summary": "业务方法 BatchUpdatePricing", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_package_batch_pricing.batch_update_pricing", + "action_name": "执行业务方法（BatchUpdatePricing）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_package_batch_pricing", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_series_grant/service.go:211:Create", + "kind": "service", + "code_entry": "internal/service/shop_series_grant/service.go:211 Create", + "owner": "shop_series_grant", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_series_grant.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_series_grant/service.go:531:Update", + "kind": "service", + "code_entry": "internal/service/shop_series_grant/service.go:531 Update", + "owner": "shop_series_grant", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_series_grant.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/shop_series_grant/service.go:735:Delete", + "kind": "service", + "code_entry": "internal/service/shop_series_grant/service.go:735 Delete", + "owner": "shop_series_grant", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "shop_series_grant.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "normal", + "primary_resource": "shop_series_grant", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/verification/service.go:36:SendCode", + "kind": "service", + "code_entry": "internal/service/verification/service.go:36 SendCode", + "owner": "verification", + "summary": "业务方法 SendCode", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "verification.send_code", + "action_name": "执行业务方法（SendCode）", + "category": "business", + "risk": "normal", + "primary_resource": "verification", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/wechat_config/service.go:195:Update", + "kind": "service", + "code_entry": "internal/service/wechat_config/service.go:195 Update", + "owner": "wechat_config", + "summary": "业务方法 Update", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "wechat_config.update", + "action_name": "执行业务方法（Update）", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/wechat_config/service.go:291:Delete", + "kind": "service", + "code_entry": "internal/service/wechat_config/service.go:291 Delete", + "owner": "wechat_config", + "summary": "业务方法 Delete", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "wechat_config.delete", + "action_name": "执行业务方法（Delete）", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/wechat_config/service.go:348:Activate", + "kind": "service", + "code_entry": "internal/service/wechat_config/service.go:348 Activate", + "owner": "wechat_config", + "summary": "业务方法 Activate", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "wechat_config.activate", + "action_name": "执行业务方法（Activate）", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/wechat_config/service.go:398:Deactivate", + "kind": "service", + "code_entry": "internal/service/wechat_config/service.go:398 Deactivate", + "owner": "wechat_config", + "summary": "业务方法 Deactivate", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "wechat_config.deactivate", + "action_name": "执行业务方法（Deactivate）", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "service:internal/service/wechat_config/service.go:69:Create", + "kind": "service", + "code_entry": "internal/service/wechat_config/service.go:69 Create", + "owner": "wechat_config", + "summary": "业务方法 Create", + "audit_event": "必须", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "调用外部系统或处理回调时必须；纯本地分支 N/A", + "outbox": "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + "action_code": "wechat_config.create", + "action_name": "执行业务方法（Create）", + "category": "business", + "risk": "high", + "primary_resource": "wechat_config", + "affected_resource": "完整用例直接修改或引用的资源", + "actor_source": "由调用入口传入操作者与来源快照", + "transaction": "关键成功事件与业务事实同一 GORM 事务", + "failure_strategy": "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical", + "sensitive_policy": "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + "before_after_policy": "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + "test_seam": "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:cmd/worker/main.go:132:constants.TaskTypeOutboxDeliver", + "kind": "worker", + "code_entry": "cmd/worker/main.go:132 outboxHandler.Handle", + "owner": "outbox_deliver", + "summary": "处理异步任务 constants.TaskTypeOutboxDeliver", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "outbox_deliver.handle", + "action_name": "处理异步任务（constants.TaskTypeOutboxDeliver）", + "category": "business", + "risk": "normal", + "primary_resource": "outbox_deliver", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:108:constants.TaskTypeOrderPackageInvalidate", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:108 orderPkgHandler.Handle", + "owner": "order_package_invalidate", + "summary": "处理异步任务 constants.TaskTypeOrderPackageInvalidate", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "order_package_invalidate.handle", + "action_name": "处理异步任务（constants.TaskTypeOrderPackageInvalidate）", + "category": "finance", + "risk": "normal", + "primary_resource": "order_package_invalidate", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:126:constants.TaskTypeDeviceImport", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:126 deviceImportHandler.HandleDeviceImport", + "owner": "device_import", + "summary": "处理异步任务 constants.TaskTypeDeviceImport", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "device_import.handle_device_import", + "action_name": "处理异步任务（constants.TaskTypeDeviceImport）", + "category": "asset", + "risk": "normal", + "primary_resource": "device_import", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:160:constants.TaskTypeExportDispatch", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:160 dispatchHandler.HandleExportDispatch", + "owner": "export_dispatch", + "summary": "处理异步任务 constants.TaskTypeExportDispatch", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "export_dispatch.handle_export_dispatch", + "action_name": "处理异步任务（constants.TaskTypeExportDispatch）", + "category": "business", + "risk": "normal", + "primary_resource": "export_dispatch", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:163:constants.TaskTypeExportShard", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:163 shardHandler.HandleExportShard", + "owner": "export_shard", + "summary": "处理异步任务 constants.TaskTypeExportShard", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "export_shard.handle_export_shard", + "action_name": "处理异步任务（constants.TaskTypeExportShard）", + "category": "business", + "risk": "normal", + "primary_resource": "export_shard", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:166:constants.TaskTypeExportFinalize", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:166 finalizeHandler.HandleExportFinalize", + "owner": "export_finalize", + "summary": "处理异步任务 constants.TaskTypeExportFinalize", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "export_finalize.handle_export_finalize", + "action_name": "处理异步任务（constants.TaskTypeExportFinalize）", + "category": "business", + "risk": "normal", + "primary_resource": "export_finalize", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:190:constants.TaskTypeCommissionStatsUpdate", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:190 updateHandler.HandleCommissionStatsUpdate", + "owner": "commission_stats_update", + "summary": "处理异步任务 constants.TaskTypeCommissionStatsUpdate", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "commission_stats_update.handle_commission_stats_update", + "action_name": "处理异步任务（constants.TaskTypeCommissionStatsUpdate）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_stats_update", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:193:constants.TaskTypeCommissionStatsSync", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:193 syncHandler.HandleCommissionStatsSync", + "owner": "commission_stats_sync", + "summary": "处理异步任务 constants.TaskTypeCommissionStatsSync", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "commission_stats_sync.handle_commission_stats_sync", + "action_name": "处理异步任务（constants.TaskTypeCommissionStatsSync）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_stats_sync", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:196:constants.TaskTypeCommissionStatsArchive", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:196 archiveHandler.HandleCommissionStatsArchive", + "owner": "commission_stats_archive", + "summary": "处理异步任务 constants.TaskTypeCommissionStatsArchive", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "commission_stats_archive.handle_commission_stats_archive", + "action_name": "处理异步任务（constants.TaskTypeCommissionStatsArchive）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission_stats_archive", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:206:constants.TaskTypeCommission", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:206 commissionCalculationHandler.HandleCommissionCalculation", + "owner": "commission", + "summary": "处理异步任务 constants.TaskTypeCommission", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "commission.handle_commission_calculation", + "action_name": "处理异步任务（constants.TaskTypeCommission）", + "category": "finance", + "risk": "normal", + "primary_resource": "commission", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:227:constants.TaskTypePollingRealname", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:227 realnameHandler.Handle", + "owner": "polling_realname", + "summary": "处理异步任务 constants.TaskTypePollingRealname", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "必须：每次实际请求或未发送裁决均记录", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "polling_realname.handle", + "action_name": "处理异步任务（constants.TaskTypePollingRealname）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_realname", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:228:constants.TaskTypePollingCarddata", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:228 carddataHandler.Handle", + "owner": "polling_carddata", + "summary": "处理异步任务 constants.TaskTypePollingCarddata", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "必须：每次实际请求或未发送裁决均记录", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "polling_carddata.handle", + "action_name": "处理异步任务（constants.TaskTypePollingCarddata）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_carddata", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:229:constants.TaskTypePollingPackage", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:229 packageHandler.Handle", + "owner": "polling_package", + "summary": "处理异步任务 constants.TaskTypePollingPackage", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "必须：每次实际请求或未发送裁决均记录", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "polling_package.handle", + "action_name": "处理异步任务（constants.TaskTypePollingPackage）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_package", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:230:constants.TaskTypePollingProtect", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:230 protectHandler.Handle", + "owner": "polling_protect", + "summary": "处理异步任务 constants.TaskTypePollingProtect", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "必须：每次实际请求或未发送裁决均记录", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "polling_protect.handle", + "action_name": "处理异步任务（constants.TaskTypePollingProtect）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_protect", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:231:constants.TaskTypePollingCardStatus", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:231 cardStatusHandler.Handle", + "owner": "polling_card_status", + "summary": "处理异步任务 constants.TaskTypePollingCardStatus", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "必须：每次实际请求或未发送裁决均记录", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "polling_card_status.handle", + "action_name": "处理异步任务（constants.TaskTypePollingCardStatus）", + "category": "asset", + "risk": "normal", + "primary_resource": "polling_card_status", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:245:constants.TaskTypePackageFirstActivation", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:245 packageActivationHandler.HandlePackageFirstActivation", + "owner": "package_first_activation", + "summary": "处理异步任务 constants.TaskTypePackageFirstActivation", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "package_first_activation.handle_package_first_activation", + "action_name": "处理异步任务（constants.TaskTypePackageFirstActivation）", + "category": "business", + "risk": "normal", + "primary_resource": "package_first_activation", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:248:constants.TaskTypePackageQueueActivation", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:248 packageActivationHandler.HandlePackageQueueActivation", + "owner": "package_queue_activation", + "summary": "处理异步任务 constants.TaskTypePackageQueueActivation", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "package_queue_activation.handle_package_queue_activation", + "action_name": "处理异步任务（constants.TaskTypePackageQueueActivation）", + "category": "business", + "risk": "normal", + "primary_resource": "package_queue_activation", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:254:constants.TaskTypeOrderExpire", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:254 orderExpireHandler.HandleOrderExpire", + "owner": "order_expire", + "summary": "处理异步任务 constants.TaskTypeOrderExpire", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "order_expire.handle_order_expire", + "action_name": "处理异步任务（constants.TaskTypeOrderExpire）", + "category": "finance", + "risk": "normal", + "primary_resource": "order_expire", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:260:constants.TaskTypeAlertCheck", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:260 alertCheckHandler.HandleAlertCheck", + "owner": "alert_check", + "summary": "处理异步任务 constants.TaskTypeAlertCheck", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "alert_check.handle_alert_check", + "action_name": "处理异步任务（constants.TaskTypeAlertCheck）", + "category": "business", + "risk": "normal", + "primary_resource": "alert_check", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:266:constants.TaskTypeDataCleanup", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:266 dataCleanupHandler.HandleDataCleanup", + "owner": "data_cleanup", + "summary": "处理异步任务 constants.TaskTypeDataCleanup", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "data_cleanup.handle_data_cleanup", + "action_name": "处理异步任务（constants.TaskTypeDataCleanup）", + "category": "business", + "risk": "normal", + "primary_resource": "data_cleanup", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:283:constants.TaskTypeAutoPurchaseAfterRecharge", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:283 autoPurchaseHandler.ProcessTask", + "owner": "auto_purchase_after_recharge", + "summary": "处理异步任务 constants.TaskTypeAutoPurchaseAfterRecharge", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "必须：订单、充值、退款、钱包流水等既有业务表是领域权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "auto_purchase_after_recharge.process_task", + "action_name": "处理异步任务（constants.TaskTypeAutoPurchaseAfterRecharge）", + "category": "finance", + "risk": "high", + "primary_resource": "auto_purchase_after_recharge", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:290:constants.TaskTypeDailyTrafficFlush", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:290 dailyTrafficFlushHandler.HandleDailyTrafficFlush", + "owner": "daily_traffic_flush", + "summary": "处理异步任务 constants.TaskTypeDailyTrafficFlush", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "daily_traffic_flush.handle_daily_traffic_flush", + "action_name": "处理异步任务（constants.TaskTypeDailyTrafficFlush）", + "category": "business", + "risk": "normal", + "primary_resource": "daily_traffic_flush", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:63:constants.TaskTypeEmailSend", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:63 emailHandler.HandleEmailSend", + "owner": "email_send", + "summary": "处理异步任务 constants.TaskTypeEmailSend", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "既有业务表是状态事实；Audit Event 不替代业务模型", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "email_send.handle_email_send", + "action_name": "处理异步任务（constants.TaskTypeEmailSend）", + "category": "business", + "risk": "normal", + "primary_resource": "email_send", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + }, + { + "key": "worker:pkg/queue/handler.go:96:constants.TaskTypeIotCardImport", + "kind": "worker", + "code_entry": "pkg/queue/handler.go:96 iotCardImportHandler.HandleIotCardImport", + "owner": "iot_card_import", + "summary": "处理异步任务 constants.TaskTypeIotCardImport", + "audit_event": "按状态变化、人工触发、连续失败或高风险异常决定", + "domain_ledger": "业务任务及明细表是批量结果权威", + "integration_log": "Worker 调用外部系统时必须；纯本地处理 N/A", + "outbox": "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + "action_code": "iot_card_import.handle_iot_card_import", + "action_name": "处理异步任务（constants.TaskTypeIotCardImport）", + "category": "asset", + "risk": "normal", + "primary_resource": "iot_card_import", + "affected_resource": "任务载荷定位的直接业务资源", + "actor_source": "system_task/asynq", + "transaction": "业务状态变化、领域流水和 Audit Event 按用例原子提交", + "failure_strategy": "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + "sensitive_policy": "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + "before_after_policy": "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + "test_seam": "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口" + } +] diff --git a/README.md b/README.md index 2a9449d..972efbd 100644 --- a/README.md +++ b/README.md @@ -2,6 +2,10 @@ 基于 Go + Fiber 框架的 HTTP 服务，集成了认证、限流、结构化日志和嵌入式配置功能。 +## 功能文档 + +- [全局审计当前实现进度](docs/tech-global-audit/当前实现进度.md) + ## 系统简介 物联网卡 + 号卡全生命周期管理平台，支持代理商体系和分佣结算。 diff --git a/cmd/audit-coverage/main.go b/cmd/audit-coverage/main.go new file mode 100644 index 0000000..f388270 --- /dev/null +++ b/cmd/audit-coverage/main.go @@ -0,0 +1,38 @@ +// audit-coverage 生成全系统审计覆盖显式清单，生成结果必须经过业务、研发和安全评审。 +package main + +import ( + "fmt" + "os" + "path/filepath" + + "github.com/break/junhong_cmp_fiber/internal/governance/auditcoverage" +) + +func main() { + if err := run(); err != nil { + _, _ = fmt.Fprintln(os.Stderr, "生成审计覆盖清单失败：", err) + os.Exit(1) + } +} + +func run() error { + root, err := os.Getwd() + if err != nil { + return err + } + entries, err := auditcoverage.Scan(root) + if err != nil { + return err + } + data, err := auditcoverage.MarshalManifest(entries) + if err != nil { + return err + } + path := filepath.Join(root, ".scratch/tech-global-audit/审计覆盖清单.json") + if err := os.WriteFile(path, append(data, '\n'), 0o644); err != nil { + return err + } + fmt.Printf("已生成 %d 条审计覆盖入口：%s\n", len(entries), path) + return nil +} diff --git a/docs/tech-global-audit/当前实现进度.md b/docs/tech-global-audit/当前实现进度.md new file mode 100644 index 0000000..2bad5e6 --- /dev/null +++ b/docs/tech-global-audit/当前实现进度.md @@ -0,0 +1,27 @@ +# 全局审计当前实现进度 + +## 已完成 + +- Integration Log 写入闭环：新增 `tb_integration_log`、稳定 Integration ID、入站幂等键、调用前 `pending` 事实、条件终态更新、结果未知恢复策略、未发送终态、中文结果名称和脱敏摘要。 +- Access Log 敏感路由加固：真实登录、Token、支付回调、文件/导出、系统配置与微信配置路由使用安全摘要；请求、响应和 Query 均先脱敏后执行 50KB 限制，Authorization/Cookie 不进入日志正文。 +- 全系统覆盖扫描：当前显式固定 490 个 HTTP、Application、Service、Worker 和定时任务入口；源码与清单不一致时静态门禁失败。 + +## 当前阻塞 + +00 号票要求《审计覆盖基线》经业务、研发和安全三方评审。源码扫描、分类、旧 Writer 清单和自动门禁已完成，但本地自动化不能替代该外部评审，因此 01 及其后续依赖票尚未解锁。 + +## 验证方式 + +```bash +go test ./internal/governance/auditcoverage +go test ./pkg/logger +go test ./internal/infrastructure/integrationlog +``` + +Integration Log 测试使用真实 PostgreSQL；覆盖门禁和 Access Log 测试不依赖外部服务。 + +## 发布边界 + +- 当前尚未切换旧账号、资产和手动轮询 Writer，不允许把本阶段单独作为一次性审计切换版本放量。 +- `tb_integration_log` 已产生事实后禁止通过 down migration 删除；应停止异常生产者并前向修复。 +- 后续必须先完成 00 三方评审，再按依赖图推进 Audit Event Writer、业务迁移、查询与 19 号停机门禁。 diff --git a/internal/governance/auditcoverage/coverage_test.go b/internal/governance/auditcoverage/coverage_test.go new file mode 100644 index 0000000..32705c6 --- /dev/null +++ b/internal/governance/auditcoverage/coverage_test.go @@ -0,0 +1,46 @@ +package auditcoverage_test + +import ( + "path/filepath" + "reflect" + "runtime" + "testing" + + "github.com/break/junhong_cmp_fiber/internal/governance/auditcoverage" +) + +func TestReviewedAuditCoverageManifestMatchesAllRegisteredEntrypoints(t *testing.T) { + _, currentFile, _, ok := runtime.Caller(0) + if !ok { + t.Fatal("无法定位覆盖门禁测试文件") + } + root := filepath.Clean(filepath.Join(filepath.Dir(currentFile), "../../../")) + actual, err := auditcoverage.Scan(root) + if err != nil { + t.Fatalf("扫描全系统入口失败：%v", err) + } + expected, err := auditcoverage.LoadManifest(filepath.Join(root, ".scratch/tech-global-audit/审计覆盖清单.json")) + if err != nil { + t.Fatalf("读取经评审审计覆盖清单失败：%v", err) + } + if len(actual) == 0 { + t.Fatal("入口扫描结果为空，覆盖门禁不可用") + } + if !reflect.DeepEqual(expected, actual) { + t.Fatalf("源码入口与审计覆盖清单不一致：清单 %d 项，源码 %d 项；请重新分类并完成评审后更新清单", len(expected), len(actual)) + } + for _, entry := range expected { + if entry.AuditEvent == "" || entry.DomainLedger == "" || entry.IntegrationLog == "" || entry.Outbox == "" || + entry.Transaction == "" || entry.FailureStrategy == "" || entry.SensitivePolicy == "" || + entry.BeforeAfterPolicy == "" || entry.TestSeam == "" { + t.Fatalf("入口 %s 存在未分类字段", entry.Key) + } + if entry.AuditEvent == "N/A" && entry.NAReason == "" { + t.Fatalf("入口 %s 的 Audit Event 为 N/A 但缺少理由", entry.Key) + } + if entry.AuditEvent != "N/A" && (entry.ActionCode == "" || entry.ActionName == "" || entry.Category == "" || + entry.Risk == "" || entry.PrimaryResource == "") { + t.Fatalf("入口 %s 缺少动作、风险或主要资源", entry.Key) + } + } +} diff --git a/internal/governance/auditcoverage/scanner.go b/internal/governance/auditcoverage/scanner.go new file mode 100644 index 0000000..4f15b8e --- /dev/null +++ b/internal/governance/auditcoverage/scanner.go @@ -0,0 +1,448 @@ +// Package auditcoverage 提供全系统入口的可复核审计覆盖扫描。 +package auditcoverage + +import ( + "fmt" + "go/ast" + "go/parser" + "go/token" + "os" + "path/filepath" + "sort" + "strconv" + "strings" + + "github.com/bytedance/sonic" +) + +// Entry 是一个必须经过审计分类的 HTTP、Worker 或定时任务入口。 +type Entry struct { + Key string `json:"key"` + Kind string `json:"kind"` + CodeEntry string `json:"code_entry"` + Owner string `json:"owner"` + Method string `json:"method,omitempty"` + Path string `json:"path,omitempty"` + Summary string `json:"summary"` + AuditEvent string `json:"audit_event"` + DomainLedger string `json:"domain_ledger"` + IntegrationLog string `json:"integration_log"` + Outbox string `json:"outbox"` + ActionCode string `json:"action_code,omitempty"` + ActionName string `json:"action_name,omitempty"` + Category string `json:"category,omitempty"` + Risk string `json:"risk,omitempty"` + PrimaryResource string `json:"primary_resource,omitempty"` + AffectedResource string `json:"affected_resource,omitempty"` + ActorSource string `json:"actor_source"` + Transaction string `json:"transaction"` + FailureStrategy string `json:"failure_strategy"` + SensitivePolicy string `json:"sensitive_policy"` + BeforeAfterPolicy string `json:"before_after_policy"` + TestSeam string `json:"test_seam"` + NAReason string `json:"na_reason,omitempty"` +} + +// Scan 扫描当前仓库中对外 HTTP、Asynq Worker 和定时任务注册入口。 +func Scan(root string) ([]Entry, error) { + var entries []Entry + files := []string{"internal/routes", "internal/application", "internal/domain", "internal/service", "pkg/queue", "cmd/worker"} + for _, directory := range files { + err := filepath.Walk(filepath.Join(root, directory), func(path string, info os.FileInfo, walkErr error) error { + if walkErr != nil { + return walkErr + } + if info.IsDir() || !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") { + return nil + } + found, err := scanFile(root, path) + if err != nil { + return err + } + entries = append(entries, found...) + return nil + }) + if err != nil { + return nil, err + } + } + sort.Slice(entries, func(i, j int) bool { return entries[i].Key < entries[j].Key }) + return entries, nil +} + +// LoadManifest 读取经评审的显式覆盖快照。 +func LoadManifest(path string) ([]Entry, error) { + data, err := os.ReadFile(path) + if err != nil { + return nil, err + } + var entries []Entry + if err := sonic.Unmarshal(data, &entries); err != nil { + return nil, err + } + return entries, nil +} + +// MarshalManifest 将扫描结果输出为稳定、便于评审的 JSON。 +func MarshalManifest(entries []Entry) ([]byte, error) { + return sonic.ConfigStd.MarshalIndent(entries, "", " ") +} + +func scanFile(root, path string) ([]Entry, error) { + set := token.NewFileSet() + file, err := parser.ParseFile(set, path, nil, 0) + if err != nil { + return nil, err + } + relative, err := filepath.Rel(root, path) + if err != nil { + return nil, err + } + var entries []Entry + ast.Inspect(file, func(node ast.Node) bool { + call, ok := node.(*ast.CallExpr) + if !ok { + return true + } + position := set.Position(call.Pos()) + if identifier, ok := call.Fun.(*ast.Ident); ok && identifier.Name == "Register" && len(call.Args) >= 7 { + method, methodOK := stringLiteral(call.Args[3]) + pathSuffix, pathOK := stringLiteral(call.Args[4]) + if methodOK && pathOK { + entry := classifyHTTP(relative, position.Line, method, pathSuffix, expression(call.Args[5]), routeSummary(call.Args[6])) + entries = append(entries, entry) + } + return true + } + selector, ok := call.Fun.(*ast.SelectorExpr) + if !ok { + return true + } + switch selector.Sel.Name { + case "HandleFunc": + if len(call.Args) >= 2 { + entries = append(entries, classifyWorker(relative, position.Line, expression(call.Args[0]), expression(call.Args[1]))) + } + case "Register": + if strings.HasPrefix(relative, "cmd/worker/") { + if taskType, schedule, ok := scheduledTask(call); ok { + entries = append(entries, classifySchedule(relative, position.Line, taskType, schedule)) + } + } + } + return true + }) + if strings.HasPrefix(relative, "internal/application/") || strings.HasPrefix(relative, "internal/domain/") || + strings.HasPrefix(relative, "internal/service/") { + for _, declaration := range file.Decls { + function, ok := declaration.(*ast.FuncDecl) + if !ok || function.Recv == nil || !isBusinessMethod(function.Name.Name) { + continue + } + position := set.Position(function.Pos()) + entries = append(entries, classifyBusinessMethod(relative, position.Line, function.Name.Name)) + } + } + return entries, nil +} + +func classifyHTTP(file string, line int, method, path, handler, summary string) Entry { + owner := strings.TrimSuffix(filepath.Base(file), ".go") + if summary == "" { + summary = handler + } + entry := Entry{ + Key: fmt.Sprintf("http:%s:%d:%s:%s", file, line, method, path), Kind: "http", + CodeEntry: fmt.Sprintf("%s:%d %s", file, line, handler), Owner: owner, + Method: method, Path: path, Summary: summary, ActorSource: httpActorSource(file), + DomainLedger: ledgerDecision(owner), IntegrationLog: integrationDecision(file, path), + Outbox: "按用例是否存在提交后可靠副作用决定；无可靠副作用时 N/A", + SensitivePolicy: "禁止字段删除；手机号、IP、ICCID、金额和第三方单号按权限脱敏；单字段 16KB 上限", + BeforeAfterPolicy: "写操作保存脱敏后的直接字段变化；批量命令保存摘要和权威明细引用", + TestSeam: "真实 Fiber + Application/Service 公共用例 + PostgreSQL 事实；覆盖门禁静态比对本入口", + } + if method == "GET" && !isSensitiveRead(file, path, summary) { + entry.AuditEvent = "N/A" + entry.Transaction = "N/A" + entry.FailureStrategy = "Access Log 记录统一错误；普通读取不创建业务审计" + entry.NAReason = "普通只读查询，不改变业务事实且不返回需二次授权的完整敏感值" + return entry + } + entry.AuditEvent = "必须" + entry.ActionCode = actionCode(owner, handler) + entry.ActionName = summary + entry.Category = categoryFor(owner) + entry.Risk = riskFor(owner, path, summary) + entry.PrimaryResource = owner + entry.AffectedResource = "由对应 Application/Service 用例按直接影响资源显式填写，禁止递归扩展" + entry.Transaction = "成功事件与关键业务事实同一 GORM 事务；敏感读取在返回前写入" + entry.FailureStrategy = "业务回滚后的 failed/denied 使用独立短事务；二次失败保留业务错误并记录 critical" + return entry +} + +func classifyWorker(file string, line int, taskType, handler string) Entry { + owner := workerOwner(taskType) + entry := Entry{ + Key: fmt.Sprintf("worker:%s:%d:%s", file, line, taskType), Kind: "worker", + CodeEntry: fmt.Sprintf("%s:%d %s", file, line, handler), Owner: owner, + Summary: "处理异步任务 " + taskType, AuditEvent: "按状态变化、人工触发、连续失败或高风险异常决定", + DomainLedger: ledgerDecision(owner), IntegrationLog: workerIntegrationDecision(taskType), + Outbox: "任务来源 Outbox/业务任务事实；消费端按稳定事件或任务 ID 幂等", + ActionCode: actionCode(owner, handler), ActionName: "处理异步任务（" + taskType + "）", + Category: categoryFor(owner), Risk: riskFor(owner, taskType, handler), + PrimaryResource: owner, AffectedResource: "任务载荷定位的直接业务资源", + ActorSource: "system_task/asynq", Transaction: "业务状态变化、领域流水和 Audit Event 按用例原子提交", + FailureStrategy: "Worker 返回错误由公共重试恢复；终态失败保存中文安全摘要，禁止裸 goroutine 审计", + SensitivePolicy: "不记录完整任务载荷、文件内容、外部正文、凭证或签名 URL", + BeforeAfterPolicy: "状态变化保存直接前后值；无业务变化时仅保留 Integration Log", + TestSeam: "公开 Asynq Handler + PostgreSQL/Redis 事实 + 重复消费测试；覆盖门禁静态比对本入口", + } + return entry +} + +func classifySchedule(file string, line int, taskType, schedule string) Entry { + return Entry{ + Key: fmt.Sprintf("schedule:%s:%d:%s", file, line, taskType), Kind: "scheduled_job", + CodeEntry: fmt.Sprintf("%s:%d", file, line), Owner: workerOwner(taskType), Summary: "按 " + schedule + " 调度 " + taskType, + AuditEvent: "N/A", DomainLedger: "N/A", IntegrationLog: "N/A", Outbox: "N/A", + ActorSource: "system_task/scheduled_job", Transaction: "N/A", + FailureStrategy: "调度注册失败阻止 Worker 启动；执行结果由对应 Worker 入口负责", + SensitivePolicy: "调度日志仅记录任务类型与安全时间信息", + BeforeAfterPolicy: "N/A：调度入口不修改业务事实", + TestSeam: "调度注册公开函数 + 覆盖门禁静态比对本入口", + NAReason: "本入口只产生调度信号，不直接读取或修改业务事实；审计责任位于对应 Worker", + } +} + +func classifyBusinessMethod(file string, line int, method string) Entry { + parts := strings.Split(file, "/") + layer := parts[1] + owner := strings.TrimSuffix(filepath.Base(filepath.Dir(file)), ".go") + if owner == "service" || owner == "application" || owner == "domain" { + owner = strings.TrimSuffix(filepath.Base(file), ".go") + } + entry := Entry{ + Key: fmt.Sprintf("%s:%s:%d:%s", layer, file, line, method), Kind: layer, + CodeEntry: fmt.Sprintf("%s:%d %s", file, line, method), Owner: owner, + Summary: "业务方法 " + method, DomainLedger: ledgerDecision(owner), + IntegrationLog: businessIntegrationDecision(file, method), + Outbox: "存在提交后可靠副作用时必须在同一事务追加；否则 N/A", + ActionCode: actionCode(owner, method), Risk: riskFor(owner, file, method), + PrimaryResource: owner, AffectedResource: "完整用例直接修改或引用的资源", + ActorSource: "由调用入口传入操作者与来源快照", + SensitivePolicy: "禁止字段删除；受控字段脱敏；批量明细留在领域任务或制品", + BeforeAfterPolicy: "完整用例保存脱敏后的直接业务变化；Domain 方法由 Application 投影", + TestSeam: "Application/Service 公共方法 + PostgreSQL 事实；Domain 使用纯领域测试；覆盖门禁静态比对本入口", + } + if layer == "domain" { + entry.AuditEvent = "N/A" + entry.Transaction = "由 Application 组合根负责" + entry.FailureStrategy = "返回领域错误，由 Application 在回滚后裁决 failed/denied 审计" + entry.NAReason = "Domain 只维护业务不变量和领域事实，不依赖审计基础设施；Audit Event 由 Application 写入" + entry.ActionCode = "" + entry.ActionName = "" + entry.Category = "" + entry.Risk = "" + entry.PrimaryResource = "" + return entry + } + entry.AuditEvent = "必须" + entry.ActionName = "执行业务方法（" + method + "）" + entry.Category = categoryFor(owner) + entry.Transaction = "关键成功事件与业务事实同一 GORM 事务" + entry.FailureStrategy = "业务回滚后的 failed/denied 使用独立短事务；审计二次失败记录 critical" + return entry +} + +func routeSummary(expr ast.Expr) string { + composite, ok := expr.(*ast.CompositeLit) + if !ok { + return "" + } + for _, element := range composite.Elts { + pair, ok := element.(*ast.KeyValueExpr) + if !ok || expression(pair.Key) != "Summary" { + continue + } + value, _ := stringLiteral(pair.Value) + return value + } + return "" +} + +func scheduledTask(call *ast.CallExpr) (string, string, bool) { + if len(call.Args) < 2 { + return "", "", false + } + schedule, _ := stringLiteral(call.Args[0]) + taskCall, ok := call.Args[1].(*ast.CallExpr) + if !ok { + return "", "", false + } + selector, ok := taskCall.Fun.(*ast.SelectorExpr) + if !ok || selector.Sel.Name != "NewTask" || len(taskCall.Args) == 0 { + return "", "", false + } + return expression(taskCall.Args[0]), schedule, true +} + +func stringLiteral(expr ast.Expr) (string, bool) { + literal, ok := expr.(*ast.BasicLit) + if !ok || literal.Kind != token.STRING { + return "", false + } + value, err := strconv.Unquote(literal.Value) + return value, err == nil +} + +func expression(expr ast.Expr) string { + switch value := expr.(type) { + case *ast.Ident: + return value.Name + case *ast.SelectorExpr: + return expression(value.X) + "." + value.Sel.Name + case *ast.BasicLit: + return value.Value + case *ast.CallExpr: + return expression(value.Fun) + default: + return fmt.Sprintf("%T", expr) + } +} + +func httpActorSource(file string) string { + switch { + case strings.HasSuffix(file, "personal.go"): + return "personal_customer/personal_api" + case strings.HasSuffix(file, "order.go"): + return "按路由分为 admin_user/admin_api 或外部回调入口" + default: + return "登录账号快照/admin_api" + } +} + +func isSensitiveRead(file, path, summary string) bool { + text := strings.ToLower(file + " " + path + " " + summary) + for _, marker := range []string{"download", "export", "realname-link", "实名", "敏感", "完整", "operation-password"} { + if strings.Contains(text, marker) { + return true + } + } + return false +} + +func integrationDecision(file, path string) string { + text := strings.ToLower(file + " " + path) + if strings.Contains(text, "callback") || strings.HasSuffix(file, "order.go") && + (strings.Contains(path, "pay") || strings.Contains(path, "alipay")) { + return "必须：业务处理前保存入站安全摘要与幂等标识" + } + return "无外部交互时 N/A；用例调用 Gateway、支付、企微或运营商时必须" +} + +func workerIntegrationDecision(taskType string) string { + text := strings.ToLower(taskType) + if strings.Contains(text, "polling") { + return "必须：每次实际请求或未发送裁决均记录" + } + return "Worker 调用外部系统时必须；纯本地处理 N/A" +} + +func businessIntegrationDecision(file, method string) string { + text := strings.ToLower(file + " " + method) + for _, marker := range []string{"polling", "gateway", "payment", "wechat", "wecom", "carrier", "sms"} { + if strings.Contains(text, marker) { + return "调用外部系统或处理回调时必须；纯本地分支 N/A" + } + } + return "N/A：当前方法按代码位置属于本地业务用例；后续新增外部调用必须重新分类" +} + +func ledgerDecision(owner string) string { + for _, marker := range []string{"order", "recharge", "refund", "commission", "wallet"} { + if strings.Contains(owner, marker) { + return "必须：订单、充值、退款、钱包流水等既有业务表是领域权威" + } + } + if strings.Contains(owner, "import") || strings.Contains(owner, "export") { + return "业务任务及明细表是批量结果权威" + } + return "既有业务表是状态事实；Audit Event 不替代业务模型" +} + +func riskFor(owner, path, summary string) string { + text := strings.ToLower(owner + " " + path + " " + summary) + for _, marker := range []string{"wallet", "refund", "recharge", "permission", "role", "password", "config", "权限", "资金", "退款", "充值"} { + if strings.Contains(text, marker) { + return "high" + } + } + return "normal" +} + +func categoryFor(owner string) string { + text := strings.ToLower(owner) + for _, marker := range []string{"wallet", "refund", "recharge", "commission", "order"} { + if strings.Contains(text, marker) { + return "finance" + } + } + for _, marker := range []string{"account", "role", "permission", "auth"} { + if strings.Contains(text, marker) { + return "security" + } + } + for _, marker := range []string{"card", "device", "asset", "polling"} { + if strings.Contains(text, marker) { + return "asset" + } + } + return "business" +} + +func actionCode(owner, handler string) string { + method := handler + if index := strings.LastIndex(method, "."); index >= 0 { + method = method[index+1:] + } + return normalize(owner) + "." + normalize(method) +} + +func workerOwner(taskType string) string { + return normalize(strings.TrimPrefix(taskType, "constants.TaskType")) +} + +func isBusinessMethod(name string) bool { + for _, prefix := range []string{ + "Create", "Update", "Delete", "Set", "Assign", "Remove", "Cancel", "Reject", "Approve", + "Import", "Allocate", "Recall", "Stop", "Resume", "Bind", "Unbind", "Reset", "Activate", + "Deactivate", "Trigger", "Handle", "Process", "Execute", "Replay", "Release", "Change", "Pay", + "Refund", "Recharge", "Withdraw", "Grant", "Revoke", "Deduct", "Credit", "Debit", "Freeze", + "Unfreeze", "Resolve", "Expire", "Invalidate", "Archive", "Cleanup", "Adjust", "Add", "Batch", + "Enable", "Disable", "Login", "Logout", "Refresh", "Upload", "Download", "Save", "Restore", + "Submit", "Sync", "Migrate", "Send", + } { + if strings.HasPrefix(name, prefix) { + return true + } + } + return false +} + +func normalize(value string) string { + value = strings.Trim(value, "\"") + var output []rune + for index, current := range []rune(value) { + if current >= 'A' && current <= 'Z' { + if index > 0 { + output = append(output, '_') + } + current += 'a' - 'A' + } + if current == '-' || current == ':' || current == '/' { + current = '_' + } + output = append(output, current) + } + return strings.Trim(strings.ReplaceAll(string(output), "__", "_"), "_") +} diff --git a/internal/infrastructure/integrationlog/repository.go b/internal/infrastructure/integrationlog/repository.go new file mode 100644 index 0000000..164e575 --- /dev/null +++ b/internal/infrastructure/integrationlog/repository.go @@ -0,0 +1,284 @@ +// Package integrationlog 提供外部交互尝试的可靠持久化能力。 +package integrationlog + +import ( + "context" + "crypto/sha256" + "encoding/hex" + "strings" + "time" + + "github.com/google/uuid" + "gorm.io/datatypes" + "gorm.io/gorm" + "gorm.io/gorm/clause" + + "github.com/break/junhong_cmp_fiber/internal/model" + "github.com/break/junhong_cmp_fiber/pkg/constants" + pkgerrors "github.com/break/junhong_cmp_fiber/pkg/errors" + "github.com/break/junhong_cmp_fiber/pkg/sanitizer" +) + +// Attempt 描述一次外部调用前必须持久化的稳定事实。 +type Attempt struct { + IntegrationID string + Provider string + Direction string + Operation string + ExternalID *string + ResourceType string + ResourceID *string + ResourceKey *string + TriggerSource *string + TriggerScene *string + TriggerSeries *string + ScheduledAt *time.Time + StartedAt *time.Time + Attempt int + RequestSummary any + Metadata any + RequestID *string + CorrelationID *string + AuditEventID *uint + InitialResult string + RecoveryStrategy *string +} + +// Completion 描述外部尝试从待处理状态进入终态的结果。 +type Completion struct { + Result string + HTTPStatus int + ProviderCode string + ProviderMessage string + ResponseSummary any + DurationMS int64 + StateChanged bool + AuditEventID *uint + RecoveryStrategy string +} + +// InboundAttempt 描述业务处理前必须保存的入站回调安全事实。 +type InboundAttempt struct { + IntegrationID string + IdempotencyKey string + Provider string + Operation string + ExternalID string + ResourceType string + ResourceID *string + ResourceKey *string + RawPayload []byte + ContentType string + RequestID *string + CorrelationID *string +} + +// Repository 负责创建稳定尝试及受控地进入终态。 +type Repository struct { + db *gorm.DB + now func() time.Time +} + +// NewRepository 创建 Integration Log Repository。 +func NewRepository(db *gorm.DB) *Repository { + return &Repository{db: db, now: time.Now} +} + +// Start 在实际调用外部系统前持久化尝试事实。 +func (r *Repository) Start(ctx context.Context, input Attempt) (*model.IntegrationLog, error) { + if r == nil || r.db == nil { + return nil, pkgerrors.New(pkgerrors.CodeInvalidStatus, "Integration Log 数据库未配置") + } + if err := validateAttempt(input); err != nil { + return nil, err + } + requestSummary, err := marshalSummary(input.RequestSummary) + if err != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeInvalidParam, err, "Integration Log 请求摘要无效") + } + metadata, err := marshalSummary(input.Metadata) + if err != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeInvalidParam, err, "Integration Log 元数据无效") + } + if input.IntegrationID == "" { + input.IntegrationID = uuid.NewString() + } + if input.Attempt <= 0 { + input.Attempt = 1 + } + if input.StartedAt == nil { + startedAt := r.now().UTC() + input.StartedAt = &startedAt + } + result := input.InitialResult + if result == "" { + result = constants.IntegrationResultPending + } + resourceType := optionalString(input.ResourceType) + log := &model.IntegrationLog{ + IntegrationID: input.IntegrationID, Provider: input.Provider, Direction: input.Direction, + Operation: input.Operation, ExternalID: input.ExternalID, ResourceType: resourceType, + ResourceID: input.ResourceID, ResourceKey: input.ResourceKey, TriggerSource: input.TriggerSource, + TriggerScene: input.TriggerScene, TriggerSeries: input.TriggerSeries, ScheduledAt: input.ScheduledAt, + StartedAt: input.StartedAt, Attempt: input.Attempt, Result: result, + RequestSummary: requestSummary, Metadata: metadata, RequestID: input.RequestID, + CorrelationID: input.CorrelationID, AuditEventID: input.AuditEventID, + RecoveryStrategy: input.RecoveryStrategy, + } + if err := r.db.WithContext(ctx).Create(log).Error; err != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, err, "写入 Integration Log 失败") + } + return log, nil +} + +// Complete 仅允许把待处理尝试条件更新为一个公开终态。 +func (r *Repository) Complete(ctx context.Context, integrationID string, completion Completion) (*model.IntegrationLog, error) { + if r == nil || r.db == nil { + return nil, pkgerrors.New(pkgerrors.CodeInvalidStatus, "Integration Log 数据库未配置") + } + if integrationID == "" || !isTerminalResult(completion.Result) { + return nil, pkgerrors.New(pkgerrors.CodeInvalidParam, "Integration Log 终态参数无效") + } + if completion.Result == constants.IntegrationResultUnknown && strings.TrimSpace(completion.RecoveryStrategy) == "" { + return nil, pkgerrors.New(pkgerrors.CodeInvalidParam, "结果未知必须记录明确恢复策略") + } + responseSummary, err := marshalSummary(completion.ResponseSummary) + if err != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeInvalidParam, err, "Integration Log 响应摘要无效") + } + updates := map[string]any{ + "result": completion.Result, "duration_ms": completion.DurationMS, + "state_changed": completion.StateChanged, "response_summary": responseSummary, + "updated_at": r.now().UTC(), + } + if completion.HTTPStatus != 0 { + updates["http_status"] = completion.HTTPStatus + } + if completion.ProviderCode != "" { + updates["provider_code"] = completion.ProviderCode + } + if completion.ProviderMessage != "" { + updates["provider_message"] = sanitizer.TextSummary(completion.ProviderMessage) + } + if completion.AuditEventID != nil { + updates["audit_event_id"] = completion.AuditEventID + } + if completion.RecoveryStrategy != "" { + updates["recovery_strategy"] = completion.RecoveryStrategy + } + result := r.db.WithContext(ctx).Model(&model.IntegrationLog{}). + Where("integration_id = ? AND result = ?", integrationID, constants.IntegrationResultPending). + Updates(updates) + if result.Error != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, result.Error, "终结 Integration Log 失败") + } + if result.RowsAffected != 1 { + return nil, pkgerrors.New(pkgerrors.CodeConflict, "Integration Log 已进入终态或不存在") + } + var saved model.IntegrationLog + if err := r.db.WithContext(ctx).Where("integration_id = ?", integrationID).First(&saved).Error; err != nil { + return nil, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, err, "读取 Integration Log 终态失败") + } + return &saved, nil +} + +// RecordInbound 在业务处理前幂等保存入站回调的安全摘要。 +func (r *Repository) RecordInbound(ctx context.Context, input InboundAttempt) (*model.IntegrationLog, bool, error) { + if r == nil || r.db == nil { + return nil, false, pkgerrors.New(pkgerrors.CodeInvalidStatus, "Integration Log 数据库未配置") + } + if input.Provider == "" || input.Operation == "" || input.IdempotencyKey == "" || len(input.RawPayload) == 0 { + return nil, false, pkgerrors.New(pkgerrors.CodeInvalidParam, "入站 Integration Log 参数无效") + } + if input.IntegrationID == "" { + input.IntegrationID = uuid.NewString() + } + hash := sha256.Sum256(input.RawPayload) + summary, err := marshalSummary(map[string]any{ + "content_type": input.ContentType, + "payload_bytes": len(input.RawPayload), + "content_hash": hex.EncodeToString(hash[:]), + }) + if err != nil { + return nil, false, pkgerrors.Wrap(pkgerrors.CodeInvalidParam, err, "入站 Integration Log 摘要无效") + } + now := r.now().UTC() + log := &model.IntegrationLog{ + IntegrationID: input.IntegrationID, IdempotencyKey: &input.IdempotencyKey, + Provider: input.Provider, Direction: constants.IntegrationDirectionInbound, Operation: input.Operation, + ExternalID: optionalString(input.ExternalID), ResourceType: optionalString(input.ResourceType), + ResourceID: input.ResourceID, ResourceKey: input.ResourceKey, StartedAt: &now, Attempt: 1, + Result: constants.IntegrationResultPending, RequestSummary: summary, + ContentHash: hex.EncodeToString(hash[:]), RequestID: input.RequestID, CorrelationID: input.CorrelationID, + } + result := r.db.WithContext(ctx).Clauses(clause.OnConflict{ + Columns: []clause.Column{{Name: "provider"}, {Name: "operation"}, {Name: "idempotency_key"}}, + DoNothing: true, + }).Create(log) + if result.Error != nil { + return nil, false, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, result.Error, "写入入站 Integration Log 失败") + } + if result.RowsAffected == 1 { + return log, true, nil + } + var existing model.IntegrationLog + if err := r.db.WithContext(ctx).Where( + "provider = ? AND operation = ? AND idempotency_key = ?", input.Provider, input.Operation, input.IdempotencyKey, + ).First(&existing).Error; err != nil { + return nil, false, pkgerrors.Wrap(pkgerrors.CodeDatabaseError, err, "读取重复入站 Integration Log 失败") + } + if existing.ContentHash != hex.EncodeToString(hash[:]) { + return nil, false, pkgerrors.New(pkgerrors.CodeConflict, "入站幂等标识对应的载荷不一致") + } + return &existing, false, nil +} + +func validateAttempt(input Attempt) error { + if input.Provider == "" || input.Operation == "" { + return pkgerrors.New(pkgerrors.CodeInvalidParam, "Integration Log 提供方和操作不能为空") + } + if input.Direction != constants.IntegrationDirectionInbound && input.Direction != constants.IntegrationDirectionOutbound { + return pkgerrors.New(pkgerrors.CodeInvalidParam, "Integration Log 方向无效") + } + if input.InitialResult != "" && input.InitialResult != constants.IntegrationResultPending && !isUnsentResult(input.InitialResult) { + return pkgerrors.New(pkgerrors.CodeInvalidParam, "Integration Log 初始结果只能是待处理或未发送终态") + } + return nil +} + +func isTerminalResult(result string) bool { + switch result { + case constants.IntegrationResultSuccess, constants.IntegrationResultFailed, constants.IntegrationResultUnknown, + constants.IntegrationResultNotFound, constants.IntegrationResultInvalidPayload, constants.IntegrationResultIgnored, + constants.IntegrationResultMerged, constants.IntegrationResultRateLimited, constants.IntegrationResultCompleted, + constants.IntegrationResultCancelled: + return true + default: + return false + } +} + +func isUnsentResult(result string) bool { + switch result { + case constants.IntegrationResultIgnored, constants.IntegrationResultMerged, constants.IntegrationResultRateLimited, + constants.IntegrationResultCompleted, constants.IntegrationResultCancelled: + return true + default: + return false + } +} + +func marshalSummary(value any) (datatypes.JSON, error) { + if value == nil { + return nil, nil + } + encoded, err := sanitizer.MarshalSummary(value) + return datatypes.JSON(encoded), err +} + +func optionalString(value string) *string { + if value == "" { + return nil + } + return &value +} diff --git a/internal/infrastructure/integrationlog/repository_integration_test.go b/internal/infrastructure/integrationlog/repository_integration_test.go new file mode 100644 index 0000000..cb2a26c --- /dev/null +++ b/internal/infrastructure/integrationlog/repository_integration_test.go @@ -0,0 +1,277 @@ +package integrationlog_test + +import ( + "context" + "fmt" + "strings" + "sync" + "testing" + + "gorm.io/gorm" + + "github.com/break/junhong_cmp_fiber/internal/infrastructure/integrationlog" + "github.com/break/junhong_cmp_fiber/internal/model" + "github.com/break/junhong_cmp_fiber/internal/testutil" + "github.com/break/junhong_cmp_fiber/pkg/constants" +) + +func TestOutboundAttemptPersistsBeforeConditionalCompletion(t *testing.T) { + db := testutil.NewPostgresTransaction(t) + createTemporaryIntegrationLogTable(t, db) + repository := integrationlog.NewRepository(db) + + attempt, err := repository.Start(context.Background(), integrationlog.Attempt{ + IntegrationID: "integration-outbound-1", + Provider: "gateway", + Direction: constants.IntegrationDirectionOutbound, + Operation: "query_card_status", + ResourceType: "iot_card", + ResourceID: testutil.StringPointer("1001"), + RequestSummary: map[string]any{ + "iccid": "8986001234567890123", + "access_token": "must-not-persist", + "credential": "must-not-persist", + "private_url": "https://must-not-persist.example", + }, + }) + if err != nil { + t.Fatalf("持久化外部尝试失败：%v", err) + } + if attempt.Result != constants.IntegrationResultPending { + t.Fatalf("调用前必须是待处理状态，得到 %q", attempt.Result) + } + if strings.Contains(string(attempt.RequestSummary), "must-not-persist") { + t.Fatalf("请求摘要泄露禁止字段：%s", attempt.RequestSummary) + } + + auditEventID := uint(77) + completed, err := repository.Complete(context.Background(), attempt.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultSuccess, + HTTPStatus: 200, + ProviderCode: "0", + ProviderMessage: "查询成功", + StateChanged: true, + AuditEventID: &auditEventID, + ResponseSummary: map[string]any{"status": "active", "secret": "must-not-persist"}, + }) + if err != nil { + t.Fatalf("终结外部尝试失败：%v", err) + } + if completed.Result != constants.IntegrationResultSuccess || !completed.StateChanged || + completed.AuditEventID == nil || *completed.AuditEventID != auditEventID { + t.Fatalf("外部尝试终态错误：%+v", completed) + } + if completed.ProviderMessage == nil || strings.Contains(*completed.ProviderMessage, "查询成功") { + t.Fatalf("不可信渠道消息必须转换为不可逆摘要：%+v", completed.ProviderMessage) + } + + if _, err := repository.Complete(context.Background(), attempt.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultFailed, + }); err == nil { + t.Fatal("既有终态不得被重复完成改写") + } +} + +func TestIntegrationResultNamesCoverEveryPublicTerminalState(t *testing.T) { + for _, result := range []string{ + constants.IntegrationResultSuccess, constants.IntegrationResultFailed, constants.IntegrationResultUnknown, + constants.IntegrationResultNotFound, constants.IntegrationResultInvalidPayload, constants.IntegrationResultIgnored, + constants.IntegrationResultMerged, constants.IntegrationResultRateLimited, constants.IntegrationResultCompleted, + constants.IntegrationResultCancelled, + } { + if constants.IntegrationResultName(result) == "" { + t.Fatalf("公开终态 %q 缺少中文名称", result) + } + } +} + +func TestInboundAttemptIsIdempotentAndNeverPersistsRawPayload(t *testing.T) { + db := testutil.NewPostgresTransaction(t) + createTemporaryIntegrationLogTable(t, db) + repository := integrationlog.NewRepository(db) + + input := integrationlog.InboundAttempt{ + IntegrationID: "integration-inbound-1", + IdempotencyKey: "wechat:callback:transaction-1", + Provider: "wechat", + Operation: "payment_callback", + ExternalID: "transaction-1", + RawPayload: []byte(`{"sign":"raw-signature","ciphertext":"raw-ciphertext"}`), + ContentType: "application/json", + } + first, created, err := repository.RecordInbound(context.Background(), input) + if err != nil || !created { + t.Fatalf("首次保存入站尝试失败：created=%v err=%v", created, err) + } + second, created, err := repository.RecordInbound(context.Background(), input) + if err != nil || created { + t.Fatalf("重复入站尝试应返回既有事实：created=%v err=%v", created, err) + } + if first.ID != second.ID || first.ContentHash == "" { + t.Fatalf("重复回调未复用稳定事实或缺少内容哈希：first=%+v second=%+v", first, second) + } + serialized := string(first.RequestSummary) + if strings.Contains(serialized, "raw-signature") || strings.Contains(serialized, "raw-ciphertext") { + t.Fatalf("入站摘要泄露原始载荷：%s", serialized) + } + conflict := input + conflict.IntegrationID = "integration-inbound-conflict" + conflict.RawPayload = []byte(`{"different":true}`) + if _, _, err := repository.RecordInbound(context.Background(), conflict); err == nil { + t.Fatal("相同入站幂等标识对应不同载荷时必须拒绝") + } +} + +func TestUnknownResultRequiresExplicitRecoveryAndUnsentAttemptIsTerminal(t *testing.T) { + db := testutil.NewPostgresTransaction(t) + createTemporaryIntegrationLogTable(t, db) + repository := integrationlog.NewRepository(db) + + pending, err := repository.Start(context.Background(), integrationlog.Attempt{ + IntegrationID: "integration-unknown-1", Provider: "wecom", + Direction: constants.IntegrationDirectionOutbound, Operation: "submit_approval", + }) + if err != nil { + t.Fatalf("准备结果未知尝试失败：%v", err) + } + if _, err := repository.Complete(context.Background(), pending.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultUnknown, + }); err == nil { + t.Fatal("结果未知必须记录明确恢复策略") + } + unknown, err := repository.Complete(context.Background(), pending.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultUnknown, RecoveryStrategy: "按原外部单号查询结果，禁止盲目重发", + }) + if err != nil || unknown.RecoveryStrategy == nil { + t.Fatalf("保存结果未知及恢复策略失败：log=%+v err=%v", unknown, err) + } + + for index, terminal := range []string{ + constants.IntegrationResultIgnored, constants.IntegrationResultMerged, constants.IntegrationResultRateLimited, + constants.IntegrationResultCompleted, constants.IntegrationResultCancelled, + } { + unsent, err := repository.Start(context.Background(), integrationlog.Attempt{ + IntegrationID: fmt.Sprintf("integration-unsent-%d", index), Provider: "gateway", + Direction: constants.IntegrationDirectionOutbound, Operation: "query_card_status", InitialResult: terminal, + }) + if err != nil || unsent.Result != terminal || unsent.HTTPStatus != nil { + t.Fatalf("未发送终态不得伪造 HTTP 结果：log=%+v err=%v", unsent, err) + } + if _, err := repository.Complete(context.Background(), unsent.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultSuccess, + }); err == nil { + t.Fatal("未发送终态不得被后续完成改写") + } + } + if _, err := repository.Start(context.Background(), integrationlog.Attempt{ + Provider: "gateway", Direction: constants.IntegrationDirectionOutbound, + Operation: "query_card_status", InitialResult: constants.IntegrationResultSuccess, + }); err == nil { + t.Fatal("实际调用结果不得绕过 pending 直接写终态") + } +} + +func TestExplicitFailureAndConcurrentCompletionKeepFirstTerminalFact(t *testing.T) { + db := testutil.NewPostgresDatabase(t) + integrationIDs := []string{"integration-failed-1", "integration-concurrent-1"} + t.Cleanup(func() { + if err := db.Where("integration_id IN ?", integrationIDs).Delete(&model.IntegrationLog{}).Error; err != nil { + t.Errorf("清理 Integration Log 并发测试数据失败：%v", err) + } + }) + if err := db.Where("integration_id IN ?", integrationIDs).Delete(&model.IntegrationLog{}).Error; err != nil { + t.Fatalf("准备 Integration Log 并发测试隔离数据失败：%v", err) + } + repository := integrationlog.NewRepository(db) + failedAttempt, err := repository.Start(context.Background(), integrationlog.Attempt{ + IntegrationID: "integration-failed-1", Provider: "gateway", + Direction: constants.IntegrationDirectionOutbound, Operation: "query_card_status", + }) + if err != nil { + t.Fatalf("准备明确失败尝试失败：%v", err) + } + failed, err := repository.Complete(context.Background(), failedAttempt.IntegrationID, integrationlog.Completion{ + Result: constants.IntegrationResultFailed, ProviderCode: "UPSTREAM_REJECTED", ProviderMessage: "上游明确拒绝", + }) + if err != nil || failed.Result != constants.IntegrationResultFailed { + t.Fatalf("明确失败未保存为失败终态：log=%+v err=%v", failed, err) + } + + attempt, err := repository.Start(context.Background(), integrationlog.Attempt{ + IntegrationID: "integration-concurrent-1", Provider: "gateway", + Direction: constants.IntegrationDirectionOutbound, Operation: "query_card_status", + }) + if err != nil { + t.Fatalf("准备并发终结尝试失败：%v", err) + } + + results := make(chan error, 2) + var group sync.WaitGroup + for _, terminal := range []string{constants.IntegrationResultSuccess, constants.IntegrationResultFailed} { + group.Add(1) + go func(result string) { + defer group.Done() + _, completeErr := repository.Complete(context.Background(), attempt.IntegrationID, integrationlog.Completion{Result: result}) + results <- completeErr + }(terminal) + } + group.Wait() + close(results) + successes := 0 + for completeErr := range results { + if completeErr == nil { + successes++ + } + } + if successes != 1 { + t.Fatalf("并发终结必须且只能一个成功，实际成功 %d 次", successes) + } + var saved model.IntegrationLog + if err := db.Where("integration_id = ?", attempt.IntegrationID).First(&saved).Error; err != nil { + t.Fatalf("读取并发终态失败：%v", err) + } + if saved.Result != constants.IntegrationResultSuccess && saved.Result != constants.IntegrationResultFailed { + t.Fatalf("并发终结未保存明确成功或失败：%+v", saved) + } +} + +func createTemporaryIntegrationLogTable(t *testing.T, db *gorm.DB) { + t.Helper() + if err := db.Exec(`CREATE TEMP TABLE tb_integration_log ( + id bigserial PRIMARY KEY, + integration_id varchar(64) NOT NULL UNIQUE, + idempotency_key varchar(160), + provider varchar(32) NOT NULL, + direction varchar(16) NOT NULL, + operation varchar(64) NOT NULL, + external_id varchar(128), + resource_type varchar(64), + resource_id varchar(128), + resource_key varchar(128), + trigger_source varchar(32), + trigger_scene varchar(128), + trigger_series varchar(64), + scheduled_at timestamptz, + started_at timestamptz, + attempt integer NOT NULL DEFAULT 1, + result varchar(20) NOT NULL, + http_status integer, + provider_code varchar(64), + provider_message varchar(500), + request_summary jsonb, + response_summary jsonb, + content_hash varchar(64), + duration_ms bigint NOT NULL DEFAULT 0, + state_changed boolean NOT NULL DEFAULT false, + metadata jsonb, + recovery_strategy varchar(255), + request_id varchar(64), + correlation_id varchar(64), + audit_event_id bigint, + created_at timestamptz NOT NULL DEFAULT NOW(), + updated_at timestamptz NOT NULL DEFAULT NOW(), + CONSTRAINT uq_test_integration_idempotency UNIQUE (provider, operation, idempotency_key) + ) ON COMMIT DROP`).Error; err != nil { + t.Fatalf("创建 Integration Log 测试表失败：%v", err) + } +} diff --git a/internal/model/integration_log.go b/internal/model/integration_log.go new file mode 100644 index 0000000..6c29d66 --- /dev/null +++ b/internal/model/integration_log.go @@ -0,0 +1,48 @@ +package model + +import ( + "time" + + "gorm.io/datatypes" +) + +// IntegrationLog 是外部交互及未发送尝试的权威持久化模型。 +type IntegrationLog struct { + ID uint `gorm:"column:id;primaryKey;autoIncrement" json:"id"` + IntegrationID string `gorm:"column:integration_id;type:varchar(64);not null;uniqueIndex" json:"integration_id"` + IdempotencyKey *string `gorm:"column:idempotency_key;type:varchar(160)" json:"idempotency_key,omitempty"` + Provider string `gorm:"column:provider;type:varchar(32);not null" json:"provider"` + Direction string `gorm:"column:direction;type:varchar(16);not null" json:"direction"` + Operation string `gorm:"column:operation;type:varchar(64);not null" json:"operation"` + ExternalID *string `gorm:"column:external_id;type:varchar(128)" json:"external_id,omitempty"` + ResourceType *string `gorm:"column:resource_type;type:varchar(64)" json:"resource_type,omitempty"` + ResourceID *string `gorm:"column:resource_id;type:varchar(128)" json:"resource_id,omitempty"` + ResourceKey *string `gorm:"column:resource_key;type:varchar(128)" json:"resource_key,omitempty"` + TriggerSource *string `gorm:"column:trigger_source;type:varchar(32)" json:"trigger_source,omitempty"` + TriggerScene *string `gorm:"column:trigger_scene;type:varchar(128)" json:"trigger_scene,omitempty"` + TriggerSeries *string `gorm:"column:trigger_series;type:varchar(64)" json:"trigger_series,omitempty"` + ScheduledAt *time.Time `gorm:"column:scheduled_at;type:timestamptz" json:"scheduled_at,omitempty"` + StartedAt *time.Time `gorm:"column:started_at;type:timestamptz" json:"started_at,omitempty"` + Attempt int `gorm:"column:attempt;type:int;not null;default:1" json:"attempt"` + Result string `gorm:"column:result;type:varchar(20);not null" json:"result"` + HTTPStatus *int `gorm:"column:http_status" json:"http_status,omitempty"` + ProviderCode *string `gorm:"column:provider_code;type:varchar(64)" json:"provider_code,omitempty"` + ProviderMessage *string `gorm:"column:provider_message;type:varchar(500)" json:"provider_message,omitempty"` + RequestSummary datatypes.JSON `gorm:"column:request_summary;type:jsonb" json:"request_summary,omitempty"` + ResponseSummary datatypes.JSON `gorm:"column:response_summary;type:jsonb" json:"response_summary,omitempty"` + ContentHash string `gorm:"column:content_hash;type:varchar(64);not null;default:''" json:"content_hash,omitempty"` + DurationMS int64 `gorm:"column:duration_ms;not null;default:0" json:"duration_ms"` + StateChanged bool `gorm:"column:state_changed;not null;default:false" json:"state_changed"` + Metadata datatypes.JSON `gorm:"column:metadata;type:jsonb" json:"metadata,omitempty"` + RecoveryStrategy *string `gorm:"column:recovery_strategy;type:varchar(255)" json:"recovery_strategy,omitempty"` + RequestID *string `gorm:"column:request_id;type:varchar(64)" json:"request_id,omitempty"` + CorrelationID *string `gorm:"column:correlation_id;type:varchar(64)" json:"correlation_id,omitempty"` + AuditEventID *uint `gorm:"column:audit_event_id" json:"audit_event_id,omitempty"` + CreatedAt time.Time `gorm:"column:created_at;type:timestamptz;not null;autoCreateTime" json:"created_at"` + UpdatedAt time.Time `gorm:"column:updated_at;type:timestamptz;not null;autoUpdateTime" json:"updated_at"` +} + +// TableName 返回外部集成日志表名。 +func (IntegrationLog) TableName() string { + return "tb_integration_log" +} diff --git a/internal/testutil/database.go b/internal/testutil/database.go index 0888d1c..2c99b9b 100644 --- a/internal/testutil/database.go +++ b/internal/testutil/database.go @@ -15,6 +15,19 @@ import ( // NewPostgresTransaction 创建自动回滚的 PostgreSQL 测试事务。 func NewPostgresTransaction(t *testing.T) *gorm.DB { + t.Helper() + db := NewPostgresDatabase(t) + tx := db.Begin() + if tx.Error != nil { + t.Fatalf("开启测试事务失败：%v", tx.Error) + } + t.Cleanup(func() { _ = tx.Rollback().Error }) + return tx +} + +// NewPostgresDatabase 创建自动关闭、可使用多个连接的 PostgreSQL 测试数据库。 +// 仅在需要验证真实并发条件更新时使用；普通集成测试仍优先使用自动回滚事务。 +func NewPostgresDatabase(t *testing.T) *gorm.DB { t.Helper() if os.Getenv("JUNHONG_DATABASE_HOST") == "" { t.Skip("未加载 .env.local，跳过依赖真实 PostgreSQL 的集成测试") @@ -27,17 +40,12 @@ func NewPostgresTransaction(t *testing.T) *gorm.DB { if err != nil { t.Fatalf("连接 PostgreSQL 失败：%v", err) } - tx := db.Begin() - if tx.Error != nil { - t.Fatalf("开启测试事务失败：%v", tx.Error) - } t.Cleanup(func() { - _ = tx.Rollback().Error if sqlDB, dbErr := db.DB(); dbErr == nil { _ = sqlDB.Close() } }) - return tx + return db } // NewRedisClient 创建真实 Redis 测试客户端并在测试结束时关闭。 diff --git a/migrations/000167_create_audit_integration_log.down.sql b/migrations/000167_create_audit_integration_log.down.sql new file mode 100644 index 0000000..27e8fd6 --- /dev/null +++ b/migrations/000167_create_audit_integration_log.down.sql @@ -0,0 +1,11 @@ +-- 已产生外部交互事实后禁止通过降级删除，避免链路历史丢失。 +DO $$ +BEGIN + IF to_regclass('tb_integration_log') IS NOT NULL + AND EXISTS (SELECT 1 FROM tb_integration_log LIMIT 1) THEN + RAISE EXCEPTION 'tb_integration_log 已存在外部交互事实，禁止删表回滚，请停止生产者后向前修复'; + END IF; +END +$$; + +DROP TABLE IF EXISTS tb_integration_log; diff --git a/migrations/000167_create_audit_integration_log.up.sql b/migrations/000167_create_audit_integration_log.up.sql new file mode 100644 index 0000000..db32355 --- /dev/null +++ b/migrations/000167_create_audit_integration_log.up.sql @@ -0,0 +1,55 @@ +-- 创建外部集成尝试权威记录；不建立外键，业务关系通过稳定 ID 显式维护。 +CREATE TABLE tb_integration_log ( + id bigserial PRIMARY KEY, + integration_id varchar(64) NOT NULL, + idempotency_key varchar(160), + provider varchar(32) NOT NULL, + direction varchar(16) NOT NULL, + operation varchar(64) NOT NULL, + external_id varchar(128), + resource_type varchar(64), + resource_id varchar(128), + resource_key varchar(128), + trigger_source varchar(32), + trigger_scene varchar(128), + trigger_series varchar(64), + scheduled_at timestamptz, + started_at timestamptz, + attempt integer NOT NULL DEFAULT 1, + result varchar(20) NOT NULL, + http_status integer, + provider_code varchar(64), + provider_message varchar(500), + request_summary jsonb, + response_summary jsonb, + content_hash varchar(64) NOT NULL DEFAULT '', + duration_ms bigint NOT NULL DEFAULT 0, + state_changed boolean NOT NULL DEFAULT false, + metadata jsonb, + recovery_strategy varchar(255), + request_id varchar(64), + correlation_id varchar(64), + audit_event_id bigint, + created_at timestamptz NOT NULL DEFAULT NOW(), + updated_at timestamptz NOT NULL DEFAULT NOW(), + CONSTRAINT uq_integration_log_id UNIQUE (integration_id), + CONSTRAINT uq_integration_log_idempotency UNIQUE (provider, operation, idempotency_key), + CONSTRAINT ck_integration_log_direction CHECK (direction IN ('inbound', 'outbound')), + CONSTRAINT ck_integration_log_result CHECK (result IN ( + 'pending', 'success', 'failed', 'unknown', 'not_found', 'invalid_payload', + 'ignored', 'merged', 'rate_limited', 'completed', 'cancelled' + )), + CONSTRAINT ck_integration_log_attempt CHECK (attempt > 0), + CONSTRAINT ck_integration_log_duration CHECK (duration_ms >= 0) +); + +CREATE INDEX idx_integration_log_time ON tb_integration_log (created_at DESC, id DESC); +CREATE INDEX idx_integration_log_provider ON tb_integration_log (provider, operation, result, created_at DESC); +CREATE INDEX idx_integration_log_resource ON tb_integration_log (resource_type, resource_id, created_at DESC); +CREATE INDEX idx_integration_log_resource_key ON tb_integration_log (resource_type, resource_key, created_at DESC); +CREATE INDEX idx_integration_log_trigger ON tb_integration_log (trigger_series, attempt); +CREATE INDEX idx_integration_log_request ON tb_integration_log (request_id, created_at ASC) WHERE request_id IS NOT NULL; +CREATE INDEX idx_integration_log_correlation ON tb_integration_log (correlation_id, created_at ASC) WHERE correlation_id IS NOT NULL; + +COMMENT ON TABLE tb_integration_log IS '外部集成调用、回调及未发送尝试记录'; +COMMENT ON COLUMN tb_integration_log.result IS '尝试结果，pending 仅为内部执行态，其余为公开终态'; diff --git a/pkg/constants/integration_log.go b/pkg/constants/integration_log.go new file mode 100644 index 0000000..dc23011 --- /dev/null +++ b/pkg/constants/integration_log.go @@ -0,0 +1,51 @@ +package constants + +const ( + // IntegrationDirectionInbound 表示外部系统调用本系统。 + IntegrationDirectionInbound = "inbound" + // IntegrationDirectionOutbound 表示本系统调用外部系统。 + IntegrationDirectionOutbound = "outbound" +) + +const ( + // IntegrationResultPending 表示外部尝试已建立但尚未终结。 + IntegrationResultPending = "pending" + // IntegrationResultSuccess 表示外部尝试成功。 + IntegrationResultSuccess = "success" + // IntegrationResultFailed 表示外部尝试明确失败。 + IntegrationResultFailed = "failed" + // IntegrationResultUnknown 表示请求已发出但结果未知，需要按记录的策略恢复。 + IntegrationResultUnknown = "unknown" + // IntegrationResultNotFound 表示外部资源不存在。 + IntegrationResultNotFound = "not_found" + // IntegrationResultInvalidPayload 表示入站载荷无效。 + IntegrationResultInvalidPayload = "invalid_payload" + // IntegrationResultIgnored 表示外部尝试被安全忽略。 + IntegrationResultIgnored = "ignored" + // IntegrationResultMerged 表示尝试被合并且未发送请求。 + IntegrationResultMerged = "merged" + // IntegrationResultRateLimited 表示尝试因限频未发送请求。 + IntegrationResultRateLimited = "rate_limited" + // IntegrationResultCompleted 表示业务已达预期，尝试提前完成且未发送请求。 + IntegrationResultCompleted = "completed" + // IntegrationResultCancelled 表示尝试已取消。 + IntegrationResultCancelled = "cancelled" +) + +// IntegrationResultName 返回外部尝试结果的中文名称。 +func IntegrationResultName(result string) string { + names := map[string]string{ + IntegrationResultPending: "待处理", + IntegrationResultSuccess: "成功", + IntegrationResultFailed: "失败", + IntegrationResultUnknown: "结果未知", + IntegrationResultNotFound: "未找到", + IntegrationResultInvalidPayload: "无效载荷", + IntegrationResultIgnored: "已忽略", + IntegrationResultMerged: "已合并", + IntegrationResultRateLimited: "已限频", + IntegrationResultCompleted: "已提前完成", + IntegrationResultCancelled: "已取消", + } + return names[result] +} diff --git a/pkg/logger/access_policy.go b/pkg/logger/access_policy.go index 2d4747f..0797e64 100644 --- a/pkg/logger/access_policy.go +++ b/pkg/logger/access_policy.go @@ -1,6 +1,7 @@ package logger import ( + "fmt" "net/url" "path/filepath" "strings" @@ -10,25 +11,34 @@ import ( // AccessPolicy 是敏感路由的安全摘要策略。 type AccessPolicy struct { - Name string - Sensitive bool - SafeFields map[string]struct{} - FileFields map[string]struct{} + Name string + Sensitive bool + PresenceOnly bool + SafeFields map[string]struct{} + ResultFields map[string]struct{} + FileFields map[string]struct{} } var ( loginPolicy = AccessPolicy{ - Name: "login_token", Sensitive: true, - SafeFields: fieldSet("username", "user_id", "account_id", "success", "result_code"), + Name: "login_token", Sensitive: true, PresenceOnly: true, + SafeFields: fieldSet("username", "user_id", "account_id", "success", "result_code"), + ResultFields: fieldSet("success", "result_code", "status"), } paymentPolicy = AccessPolicy{ - Name: "payment", Sensitive: true, - SafeFields: fieldSet("order_no", "payment_no", "channel", "payment_method", "result_code", "amount", "status"), + Name: "payment", Sensitive: true, PresenceOnly: true, + SafeFields: fieldSet("order_no", "payment_no", "channel", "payment_method", "result_code", "amount", "status"), + ResultFields: fieldSet("result_code", "status"), } wecomPolicy = AccessPolicy{ Name: "wecom_callback", Sensitive: true, SafeFields: fieldSet("event_type", "resource_type", "resource_id", "result_code", "status"), } + configPolicy = AccessPolicy{ + Name: "sensitive_config", Sensitive: true, PresenceOnly: true, + SafeFields: fieldSet("config_key", "value_type", "module", "readonly", "sensitive", "configured", "status", "result_code"), + ResultFields: fieldSet("readonly", "sensitive", "configured", "status", "result_code"), + } filePolicy = AccessPolicy{ Name: "file_export", Sensitive: true, SafeFields: fieldSet("content_type", "file_size", "size", "count", "task_id", "status", "result_code"), @@ -50,6 +60,8 @@ func policyForPath(path string) AccessPolicy { switch { case strings.Contains(normalized, "/login"), strings.Contains(normalized, "token"): return loginPolicy + case strings.Contains(normalized, "/system-configs"), strings.Contains(normalized, "/wechat-configs"): + return configPolicy case strings.Contains(normalized, "/callback") && (strings.Contains(normalized, "wecom") || strings.Contains(normalized, "wework")): return wecomPolicy case strings.Contains(normalized, "payment"), strings.Contains(normalized, "wechat-pay"), @@ -102,7 +114,13 @@ func collectSafeFields(value any, policy AccessPolicy, output map[string]any) { case string: collectSafeScalar(key, scalar, policy, output) case float64, bool: - if _, allowed := policy.SafeFields[strings.ToLower(key)]; allowed { + if policy.PresenceOnly { + if _, isResult := policy.ResultFields[strings.ToLower(key)]; isResult { + output[key] = scalar + } else { + output[key] = map[string]any{"present": true, "length": len(fmt.Sprint(scalar))} + } + } else if _, allowed := policy.SafeFields[strings.ToLower(key)]; allowed { output[key] = scalar } default: @@ -118,6 +136,14 @@ func collectSafeFields(value any, policy AccessPolicy, output map[string]any) { func collectSafeScalar(key, value string, policy AccessPolicy, output map[string]any) { normalized := strings.ToLower(key) + if policy.PresenceOnly { + if _, isResult := policy.ResultFields[normalized]; isResult { + output[key] = value + return + } + output[key] = map[string]any{"present": true, "length": len(value)} + return + } if _, isFileName := policy.FileFields[normalized]; isFileName { base := filepath.Base(value) hash := digest([]byte(base)) diff --git a/pkg/logger/middleware.go b/pkg/logger/middleware.go index c7b19cf..5d88609 100644 --- a/pkg/logger/middleware.go +++ b/pkg/logger/middleware.go @@ -5,10 +5,10 @@ import ( "crypto/sha256" "encoding/hex" "net/url" - "strings" "time" "github.com/break/junhong_cmp_fiber/pkg/constants" + "github.com/break/junhong_cmp_fiber/pkg/sanitizer" "github.com/bytedance/sonic" "github.com/gofiber/fiber/v2" "go.uber.org/zap" @@ -135,20 +135,7 @@ func sanitizeJSONValue(value any) { // shouldMaskField 判断字段名是否属于访问日志敏感字段 func shouldMaskField(key string) bool { - normalized := strings.ToLower(key) - return strings.Contains(normalized, "password") || - strings.Contains(normalized, "passwd") || - strings.Contains(normalized, "credential") || - strings.Contains(normalized, "authorization") || - strings.Contains(normalized, "cookie") || - strings.Contains(normalized, "key") || - strings.Contains(normalized, "url") || - strings.Contains(normalized, "qr_content") || - strings.Contains(normalized, "verification_code") || - strings.Contains(normalized, "sign") || - strings.Contains(normalized, "nonce") || - strings.Contains(normalized, "token") || - strings.Contains(normalized, "secret") + return sanitizer.IsForbiddenField(key) } // Middleware 创建 Fiber 日志中间件 diff --git a/pkg/logger/middleware_test.go b/pkg/logger/middleware_test.go index bad12ff..adde507 100644 --- a/pkg/logger/middleware_test.go +++ b/pkg/logger/middleware_test.go @@ -92,6 +92,8 @@ func TestSensitiveRouteMatrixNeverLogsRawPayload(t *testing.T) { }) request := httptest.NewRequest("POST", tc.path+"?signature=query-secret", strings.NewReader(tc.body)) request.Header.Set("Content-Type", tc.contentType) + request.Header.Set("Authorization", "Bearer header-secret") + request.Header.Set("Cookie", "session=cookie-secret") response, err := app.Test(request) if err != nil { t.Fatalf("执行敏感路由请求失败：%v", err) @@ -99,7 +101,7 @@ func TestSensitiveRouteMatrixNeverLogsRawPayload(t *testing.T) { _, _ = io.Copy(io.Discard, response.Body) _ = response.Body.Close() logged := output.String() - for _, secret := range []string{tc.secret, "query-secret", "response-secret"} { + for _, secret := range []string{tc.secret, "query-secret", "response-secret", "header-secret", "cookie-secret"} { if strings.Contains(logged, secret) { t.Fatalf("敏感路由日志泄露 %q：%s", secret, logged) } @@ -131,6 +133,92 @@ func TestSensitiveRouteLongBodyRecordsTruncationWithoutRawSecret(t *testing.T) { } } +func TestRealConfigurationRoutesOnlyLogSafeSummary(t *testing.T) { + for _, path := range []string{ + "/api/admin/system-configs/payment.private_key", + "/api/admin/wechat-configs/1", + } { + t.Run(path, func(t *testing.T) { + var output bytes.Buffer + log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel)) + app := fiber.New() + app.Use(MiddlewareWithLogger(log)) + app.Put(path, func(c *fiber.Ctx) error { + return c.JSON(fiber.Map{"value": "response-private-material", "status": "ok"}) + }) + request := httptest.NewRequest("PUT", path, strings.NewReader(`{"value":"request-private-material","config_key":"payment.private_key"}`)) + request.Header.Set("Content-Type", "application/json") + response, err := app.Test(request) + if err != nil { + t.Fatalf("执行配置路由请求失败：%v", err) + } + _ = response.Body.Close() + logged := output.String() + for _, secret := range []string{"request-private-material", "response-private-material"} { + if strings.Contains(logged, secret) { + t.Fatalf("配置路由日志泄露 %q：%s", secret, logged) + } + } + if !strings.Contains(logged, `"body_policy":"sensitive_config"`) { + t.Fatalf("配置路由未应用安全摘要策略：%s", logged) + } + if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"length\":`) { + t.Fatalf("配置路由未记录字段存在性和长度：%s", logged) + } + }) + } +} + +func TestLoginRouteDoesNotLogUsernameAndOnlyKeepsPresenceLength(t *testing.T) { + var output bytes.Buffer + log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel)) + app := fiber.New() + app.Use(MiddlewareWithLogger(log)) + app.Post("/api/auth/login", func(c *fiber.Ctx) error { + return c.JSON(fiber.Map{"username": "visible-user", "success": true}) + }) + request := httptest.NewRequest("POST", "/api/auth/login", strings.NewReader(`{"username":"visible-user","password":"login-secret"}`)) + request.Header.Set("Content-Type", "application/json") + response, err := app.Test(request) + if err != nil { + t.Fatalf("执行登录请求失败：%v", err) + } + _ = response.Body.Close() + logged := output.String() + if strings.Contains(logged, "visible-user") || strings.Contains(logged, "login-secret") { + t.Fatalf("登录路由泄露账号或凭证：%s", logged) + } + if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"length\":`) { + t.Fatalf("登录路由未记录字段存在性和长度：%s", logged) + } +} + +func TestPaymentRouteOnlyLogsPresenceLengthAndSafeResult(t *testing.T) { + var output bytes.Buffer + log := zap.New(zapcore.NewCore(zapcore.NewJSONEncoder(zap.NewProductionEncoderConfig()), zapcore.AddSync(&output), zapcore.InfoLevel)) + app := fiber.New() + app.Use(MiddlewareWithLogger(log)) + app.Post("/api/callback/alipay", func(c *fiber.Ctx) error { + return c.JSON(fiber.Map{"payment_no": "PAY-SECRET-1", "amount": 12345, "status": "success"}) + }) + request := httptest.NewRequest("POST", "/api/callback/alipay", strings.NewReader("order_no=ORDER-SECRET-1&amount=12345&sign=signature-secret")) + request.Header.Set("Content-Type", "application/x-www-form-urlencoded") + response, err := app.Test(request) + if err != nil { + t.Fatalf("执行支付路由请求失败：%v", err) + } + _ = response.Body.Close() + logged := output.String() + for _, value := range []string{"PAY-SECRET-1", "ORDER-SECRET-1", "signature-secret"} { + if strings.Contains(logged, value) { + t.Fatalf("支付路由泄露原值 %q：%s", value, logged) + } + } + if !strings.Contains(logged, `\"present\":true`) || !strings.Contains(logged, `\"status\":\"success\"`) { + t.Fatalf("支付路由缺少存在性摘要或安全结果：%s", logged) + } +} + func TestSanitizeInvalidJSONNeverFallsBackToRawBody(t *testing.T) { t.Parallel() diff --git a/pkg/sanitizer/sanitizer.go b/pkg/sanitizer/sanitizer.go new file mode 100644 index 0000000..1e59671 --- /dev/null +++ b/pkg/sanitizer/sanitizer.go @@ -0,0 +1,76 @@ +// Package sanitizer 提供 Access、Audit 与 Integration 共用的敏感字段清理能力。 +package sanitizer + +import ( + "crypto/sha256" + "encoding/hex" + "fmt" + "strings" + + "github.com/bytedance/sonic" +) + +var forbiddenFragments = []string{ + "password", "passwd", "credential", "operation_password", "verification_code", "captcha", + "access_token", "refresh_token", "authorization", "cookie", "secret", "private_key", "public_key", + "encoding_aes_key", "callback_token", "signature", "sign", "nonce", "media_id", "signed_url", + "private_url", "qr_content", "id_card", "identity_number", +} + +// IsForbiddenField 判断字段是否禁止进入普通日志、审计或外部交互摘要。 +func IsForbiddenField(key string) bool { + normalized := strings.ToLower(strings.NewReplacer("-", "_", ".", "_").Replace(key)) + for _, fragment := range forbiddenFragments { + if strings.Contains(normalized, fragment) { + return true + } + } + if strings.HasSuffix(normalized, "_key") || normalized == "key" || strings.HasSuffix(normalized, "_url") || normalized == "url" { + return true + } + return false +} + +// MarshalSummary 递归删除禁止字段并返回 sonic 编码的安全 JSON。 +func MarshalSummary(value any) ([]byte, error) { + if value == nil { + return nil, nil + } + encoded, err := sonic.Marshal(value) + if err != nil { + return nil, err + } + var normalized any + if err := sonic.Unmarshal(encoded, &normalized); err != nil { + return nil, err + } + RemoveForbiddenFields(normalized) + return sonic.Marshal(normalized) +} + +// RemoveForbiddenFields 原地递归删除 Map 或数组中的禁止字段。 +func RemoveForbiddenFields(value any) { + switch typed := value.(type) { + case map[string]any: + for key, item := range typed { + if IsForbiddenField(key) { + delete(typed, key) + continue + } + RemoveForbiddenFields(item) + } + case []any: + for _, item := range typed { + RemoveForbiddenFields(item) + } + } +} + +// TextSummary 将不可信外部文本转换为不可逆大小和哈希摘要。 +func TextSummary(value string) string { + if value == "" { + return "" + } + sum := sha256.Sum256([]byte(value)) + return fmt.Sprintf("外部文本摘要 bytes=%d sha256=%s", len(value), hex.EncodeToString(sum[:8])) +}